Overview

overview

7

Static

static

3

fd61e4b160...f7.exe

windows10-2004-x64

7

fd61e4b160...f7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/10/2026, 09:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
  • Size 3.9MB
  • Sample261001-lapkrazv2j
  • SHA256 fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8056.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a818F.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4488
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8807.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3260
              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4532
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B53.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:228
                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4508
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FD7.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:756
                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4640
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a947B.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:64
                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3400
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99DA.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3172
                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1772
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C0C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4848
                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:2456
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FC5.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1604
                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3252
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA39E.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3672
                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:600
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA94B.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3056
                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4472
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE0E.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3048
                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4736
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB205.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1320
                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4760
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B5.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3872
                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4672
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB745.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1544
                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1268
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC75.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1836
                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5000
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC109.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3912
                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1684
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4D2.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3180
                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1904
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC83D.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4416
                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2996
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1F.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4348
                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4636
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3900
                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3320
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDF9.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1784
                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4268
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE67.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2644
                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3040
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC5.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2324
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1128
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF42.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1560
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2416
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFAF.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3852
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3240
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD01C.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:392
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:876
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD08A.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3796
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3864
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0E7.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4800
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2392
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD145.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5116
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4544
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1A3.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:368
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2532
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD201.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2136
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3324
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24F.bat
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:632
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3736
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2BC.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:4600
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1636
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD31A.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:764
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1480
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD368.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:468
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:320
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C6.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:2272
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1848
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD433.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4084
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3784
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4A1.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2412
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4776
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FE.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2196
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:4384
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD57B.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                                PID:1244
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:880
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD685.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:1940
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:4480
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7EC.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:4272
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4092
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D7.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:1168
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3512
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA1F.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:3488
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDADA.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3772
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA5.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4080
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBF.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2308
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE55.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:3944
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2912
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEE2.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:2696
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3616
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF6E.bat
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE00A.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A7.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE172.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE22D.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2E9.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:4908
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE375.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE421.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3076
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4AE.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:1032
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4628
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A8.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                  PID:1864
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                    125⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE625.bat
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                          PID:1956
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D1.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7CB.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4960
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C5.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:2744
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9A0.bat
                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:3724
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:400
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA8A.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB36.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC5F.bat
                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                          PID:1532
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED2A.bat
                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:3232
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF5.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEED0.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:2092
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF7C.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                          PID:2368
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF076.bat
                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17F.bat
                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF24A.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2F6.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1552
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3A2.bat
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF47D.bat
                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF538.bat
                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:716
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF613.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AF.bat
                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:2216
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF77A.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:752
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF826.bat
                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a219.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a390.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a630.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a788.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1576
                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                      18⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Enumerates connected drives
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3572
                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                        19⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:932
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                          20⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3404
                                                                                    • C:\Windows\Logo1_.exe
                                                                                      C:\Windows\Logo1_.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Enumerates connected drives
                                                                                      • Drops file in Program Files directory
                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4440
                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                        3⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:452
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                          4⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4992
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 712
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:536
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 700
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:3012
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4440 -ip 4440
                                                                                    1⤵
                                                                                      PID:4672
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4440 -ip 4440
                                                                                      1⤵
                                                                                        PID:2392

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            $$a8056.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8056.bat
                                                                                            • Size 722B
                                                                                            • SHA256 c17350091cc6a69a099b877281c59c59f2e48c688adc0384cdc3489680852ef2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a818F.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a818F.bat
                                                                                            • Size 722B
                                                                                            • SHA256 59cfb9e7bb5f75969ce28dc930f96ffa03c8d4c5d1c51ffd4d121768fc916909
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a8807.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8807.bat
                                                                                            • Size 722B
                                                                                            • SHA256 f2fc3979647c0c5b8d63a84aeedfcd44c93f8bc1682fc438f1f4e5a057cb226f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a8B53.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8B53.bat
                                                                                            • Size 722B
                                                                                            • SHA256 8e7bd4073f84679855ca04190f2e5eb7572fb3334e6a05250488c4fb4f5231d7
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a8FD7.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8FD7.bat
                                                                                            • Size 722B
                                                                                            • SHA256 36e5218ede3651297cce0e4013c978524add85f8019d84c2df97264089598fa1
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a947B.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a947B.bat
                                                                                            • Size 722B
                                                                                            • SHA256 510aba9e0a4172f3e90b87b68094e804e7fa120f706050916c12bbf209b17872
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a99DA.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a99DA.bat
                                                                                            • Size 722B
                                                                                            • SHA256 5d8ec9faa6d321439a20ee4e714f8dea0375dd175b63f97c20b4a8879371c0e0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a9C0C.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9C0C.bat
                                                                                            • Size 722B
                                                                                            • SHA256 56f083bea7352c06da69666d0151e1b109db7d384b3ba273e56834ceb92f1ad4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a9FC5.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9FC5.bat
                                                                                            • Size 722B
                                                                                            • SHA256 0b08dbbddd7022a1a828bd03921f08660e1e940b0412f5b8befd8c8a29690d2a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aA39E.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA39E.bat
                                                                                            • Size 722B
                                                                                            • SHA256 9568ccf89cd1089a93a2a88f05eb1329dde02c29b8368c3a4822a91c90ef38d1
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aA94B.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA94B.bat
                                                                                            • Size 722B
                                                                                            • SHA256 a8a20cfaf75f62951d022df354bcd07b7028c7a6c86d9b9dcacdf6b1d7213102
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aAE0E.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAE0E.bat
                                                                                            • Size 722B
                                                                                            • SHA256 cdbd687dd60ce5dd113485e7887cb98eced4cdf9c6278938859a131bce26142a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aB205.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB205.bat
                                                                                            • Size 722B
                                                                                            • SHA256 27ea64559e8d8d543bfb9eef705d5e2a04eedefa201c95f0af6c4f10c4303183
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aB4B5.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB4B5.bat
                                                                                            • Size 722B
                                                                                            • SHA256 8119a457628c21b3dd3de24ebbdc62a3371e990983de14a8f9fca789ce6eab79
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aB745.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB745.bat
                                                                                            • Size 722B
                                                                                            • SHA256 2dce8873857c0ea1dcf1293c0f4d3a1d8b2f208e884bbbef54256448e4961cda
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aBC75.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBC75.bat
                                                                                            • Size 722B
                                                                                            • SHA256 ed0cfdba3f8621c87ef11f2d483dda6f9f58724a9b842326ec9f3a799d6a2add
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC109.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC109.bat
                                                                                            • Size 722B
                                                                                            • SHA256 f570e5801329db0eba8d846f2657b42c84f09282d2dabd46f142071efd031d3c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC4D2.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC4D2.bat
                                                                                            • Size 722B
                                                                                            • SHA256 9e834961b7c1b1fd88846590497cbc24b785015d3e4df9be18de692849ebc298
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 396615a44443907a5cb3b94847115bc66b6f08af69fd26f385f3061ba5eb9e45
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.8MB
                                                                                            • SHA256 99a15159bfcddeb42d1362368023675e4cb4da3d6b504d3a9baa412296b2a45c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 c51d524aa01c116230ba9dcdf117f1767dfe1c556495ff892d09b73aec7f8e45
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.8MB
                                                                                            • SHA256 64b56764498106e8bbdb80d17ecfee07a97ec91181b5a2f5f1b0ff4386ae75f5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 e2e2160b9c12df831fd61c59e617d65f6453a61b612ce16cecdcb75c5c31e37f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.8MB
                                                                                            • SHA256 fabdf0cfe9fd2506291a7bcd59d1c33a7e79d4075efbd73ea697f5f3f1aa54dc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 8c681c12d704c7bdd0c278c5b3d20ac711a818d9a30d90468a892fd197a83360
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 9d8dd2291d33a9db7780c0bfefa2c7171e4617e24023909dd1f4938edf8087c9
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 c23e305a54fd01f2f66cd6039466cf11c1220486a2f1dc7ee45cc792160847dc
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 ba73357bc5346266c0dad2686306c73fceb5b5c7ec7b6f4ac71dd66ea65f7eda
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 a44813db14e3d279b7a635bd2f90c9d3fcede11ce393d4b5cbdc64eed42fddc2
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 e92a6735d9b2eb8d0880d4e0d8742c4744b86ed174c45dd71360cb781aa05d5d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 76e10a1649de7e1765dde229dd494199f6c45d68bcfa152dcc787d5f6755b11b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 011cc5be13cba180468b7cea37b03703bc963edfe8015111ca5d521968a12464
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 f09f0c21e7b66a1b1c4ab3ad99f80a96aba839f2adc5bf2f923a88eef5ece5d0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 c4c53a5db8bd198dc97ed58388439bde499f78459ac460602e7d9c1018165742
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 6be5ba0f82cebf6ec77e22912b6e3462133b02352feadf8d4b041c4adf550e2e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\fd61e4b160aa7d1a627d4815fe7ca3ccc791dbd8e9a6807aa3c429a274244ef7.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 68e82d6ca7a5be7d89cf0d50e2893a6155dbc16f014c5bae4a7a51d892bf64c0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Dll.dll
                                                                                            • Path C:\Windows\Dll.dll
                                                                                            • Size 68KB
                                                                                            • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Logo1_.exe
                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                            • Size 32KB
                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _desktop.ini
                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-240542094-4193773837-3211495583-1000\_desktop.ini
                                                                                            • Size 9B
                                                                                            • SHA256 4847b97cf00df4928ed5c4f8ca2a0ead0bf62534d7e9c6ba23326137ddbb5c6f
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            memory/220-838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/320-545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/400-672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/448-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/464-629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/552-768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/564-833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/600-413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/876-509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/880-565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/924-848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1052-858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1128-496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1140-758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1208-748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1224-667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1268-450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1288-823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1292-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1292-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1332-843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1480-541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1524-798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1532-687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1552-728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1636-537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1684-501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1684-464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1772-377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1804-713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1824-803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1832-773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1848-549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1904-472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1928-617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1956-653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2096-723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2212-625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2216-753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2268-863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2356-609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2384-868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2392-517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2416-500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2424-703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2456-392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2532-525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2852-853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2860-783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2912-601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2924-869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2996-476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3040-492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3076-637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3240-505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3252-402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3252-398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3320-484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3324-529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3400-369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3488-581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3512-577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3540-733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3572-468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3572-444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3572-391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3600-718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3616-605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3656-743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3736-533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3772-585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3784-553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3788-621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3828-788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3864-513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3892-677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3916-763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4080-589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4092-573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4108-818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4160-682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4176-778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4268-488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4292-593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4336-649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4344-641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4384-561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4440-373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4440-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4440-380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4452-657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4456-793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4460-613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4472-420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4480-569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4488-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4508-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4508-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4532-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4544-521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4588-692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4596-813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4628-645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4636-480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4640-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4648-698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4672-442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4736-428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4736-424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4760-435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4776-557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4860-738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4888-633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4896-597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4960-662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4972-708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4980-828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4984-808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5000-457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download