Overview

overview

7

Static

static

3

8466437b5f...6f.exe

windows10-2004-x64

7

8466437b5f...6f.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 06:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
  • Size 3.6MB
  • Sample261002-hr4jfsw1dv
  • SHA256 8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:6068
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AB2.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:124
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4456
              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4900
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F75.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4888
                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4612
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:936
                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1632
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3852
                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5756
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5056
                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2124
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a982F.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2156
                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5084
                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4780
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C94.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3456
                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4952
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA203.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2656
                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:484
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA416.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4452
                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5708
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4104
                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5704
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1532
                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2024
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5124
                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5924
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3920
                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4724
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3200
                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2456
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4836
                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5424
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4116
                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5176
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2D.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3204
                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5344
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD037.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5868
                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1000
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD131.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2508
                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4788
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4688
                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:880
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5264
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3620
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD44E.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1392
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5464
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD567.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:296
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5180
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD690.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:6136
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2596
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76B.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5144
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:264
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD884.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2008
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2440
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD99D.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1068
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1160
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                                                                              62⤵
                                                                                                                                PID:5504
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1840
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB91.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1156
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1176
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCBA.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4520
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5796
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE02.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1372
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1384
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEFC.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:1220
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4488
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE025.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:4232
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4904
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1164
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2484
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5072
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5388
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:1792
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2064
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4460
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5764
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1932
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:2448
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1332
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:5380
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE70B.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4648
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7E5.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:4712
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3452
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE91E.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1488
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                            91⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:5632
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9F9.bat
                                                                                                                                                                                              92⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2592
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                93⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD3.bat
                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECB8.bat
                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                            PID:2056
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDA2.bat
                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2352
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF48.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF023.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0AF.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2432
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF15B.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1E8.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF284.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5460
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF311.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3AD.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1912
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF449.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5188
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4D6.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5960
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF582.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:4464
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6CA.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:3564
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF756.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1204
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7E3.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:4248
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF870.bat
                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:4516
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8FC.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA06.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA93.bat
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:3960
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB1F.bat
                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBAC.bat
                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                    PID:3964
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCC5.bat
                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                              PID:3164
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD61.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDDE.bat
                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2188
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF55.bat
                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1804
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:52
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F.bat
                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3088
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10B.bat
                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D6.bat
                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2248
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D.bat
                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:5268
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a437.bat
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3588
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66A.bat
                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3732
                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                            C:\Windows\Logo1_.exe
                                                                                                            26⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Enumerates connected drives
                                                                                                            • Drops file in Windows directory
                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1796
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                              27⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1416
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                28⤵
                                                                                                                  PID:2432
                                                            • C:\Windows\Logo1_.exe
                                                              C:\Windows\Logo1_.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Enumerates connected drives
                                                              • Drops file in Program Files directory
                                                              • Drops file in Windows directory
                                                              • Reads the TCP/IP host and domain name from the registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4736
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net stop "Kingsoft AntiVirus Service"
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1824
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                  4⤵
                                                                    PID:2060
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1008
                                                                  3⤵
                                                                  • Program crash
                                                                  PID:5432
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4736 -ip 4736
                                                              1⤵
                                                                PID:4492

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    $$a8766.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
                                                                    • Size 722B
                                                                    • SHA256 16a5518c4c9afeab20c7b85bc033ad8e07375b7917be69245518522a640646cf
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a8AB2.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8AB2.bat
                                                                    • Size 722B
                                                                    • SHA256 9a39885a674e58427fada8d7b36b04eb784bad58712f1653f1a3c71032f42420
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a8DDE.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                    • Size 722B
                                                                    • SHA256 d939044ce36e78bea15ffb8505c38ddf60c84472dfcd1b66bb79bb7ddc4607c2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a8F75.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8F75.bat
                                                                    • Size 722B
                                                                    • SHA256 cc6a48f5733632816d9ab6c97d5bc4f882021fc8ccf7ef634ae68f82e683510b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a91A7.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                                    • Size 722B
                                                                    • SHA256 ee6a6cafcf72449901c5261d7352c9a92c5afe04fec9a9e1ec48648bf3cb8c37
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a93DA.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                    • Size 722B
                                                                    • SHA256 d91796913fd0cbae7cfc523e325e09b5b9f5d60865927c8b5618540e72a07d6b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a963B.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                                                                    • Size 722B
                                                                    • SHA256 0f155d46c9d4b927c8845213f02a3562fc96a7a74f2bdcc3a02785d38b3eb642
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a982F.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a982F.bat
                                                                    • Size 722B
                                                                    • SHA256 1a64a268e35f05f6ca2544384a94a8848de97b81aff4998b9b97c55922dc3376
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a9A81.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                                                    • Size 722B
                                                                    • SHA256 af0378e3552863d6d08a5bf5a6ee52ee6552bdb41b5971e0fef34568533fe322
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$a9C94.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9C94.bat
                                                                    • Size 722B
                                                                    • SHA256 bf7dc625df49918966793fce506519e231c734f0af6e97c56edf8e75f81ef3c5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aA203.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA203.bat
                                                                    • Size 722B
                                                                    • SHA256 c6c24eeec85cb43711f19ae9c6a9b2e041dab2f8549a456b64e212d69e0a885f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aA416.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA416.bat
                                                                    • Size 722B
                                                                    • SHA256 e35629781f3e5c78df595dd233ce02caaf9e7e03224e60d05becf4735433b4f7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aA80E.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                    • Size 722B
                                                                    • SHA256 6b376867bbc19e7ec77a53790bc26140c940c426ebb6afc0a8fb51194bdb017d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aABC7.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                                    • Size 722B
                                                                    • SHA256 7f81542322714c3b369307258ef312a6482cbbf8b2b65e16b66bd18ae3fdbda1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aB1C2.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                    • Size 722B
                                                                    • SHA256 0193bc3b42a7feea5b4404f6620e84a66b86206d50e56e94485421f832a059d5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aB740.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                    • Size 722B
                                                                    • SHA256 46bcbde0aa000fbbc118512e9846aadc9c1c3f424688dbc16be60af24c5817fb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aBD3B.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                    • Size 722B
                                                                    • SHA256 89ac8a1ea757d2a7abc9ab624525f18ab9879230efd0888b9af23b356b2cdc55
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    $$aC3D3.bat
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                    • Size 722B
                                                                    • SHA256 57ae1f4103836a52fbeda8e842a290698edbf0dc2ee31881dd82fd8054a8500d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.5MB
                                                                    • SHA256 370381c6d9357ad3b820ca70d7b61b625bab47fa3e48774b0a54c48e12e32028
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.5MB
                                                                    • SHA256 ff21a3efda98f6498a963d175ae20fcbe6fe34f2e2243f44c99ebad4cf4e3181
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.4MB
                                                                    • SHA256 1f2d3bf24cdd2f6d5e7ead8b9b437034293c9f0f3832f807338d5aa830bd8a0f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.3MB
                                                                    • SHA256 05802be7b298e5f517ca4cc41200fe43deb4308bdbfaeb8c843f3ed7418fe9a4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.1MB
                                                                    • SHA256 a00d29545681852bea72ea62d76d408c980bc079d1b6fce92f4237ff0865a4ce
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.2MB
                                                                    • SHA256 aafa249aabb171191398dfd5d9b92717ad310587a6b6f61ac1396a192fd23f83
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.3MB
                                                                    • SHA256 5fe63aadbd67b2295e7e9dcb68c247508f3b62b0918489a320c01b7db4d1297f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.0MB
                                                                    • SHA256 238158423ec6ef52d83d65c920fa5274bbe323956b0ea3022f94639231d5a327
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.2MB
                                                                    • SHA256 d4a3e6bdc4ab341b0fdbc372f57b393df6e01d824e1dd9e04457ce1417432c47
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.5MB
                                                                    • SHA256 633e1220dc5896061a2e84c98d8825827581d078a0d584ef05ba46314d2bf344
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.4MB
                                                                    • SHA256 1392bae2fffb93942e12cc8a3ef294686ece48f75cfe0f93cfce38356f37d78e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.4MB
                                                                    • SHA256 456c4854a8e68bd3a7f67588419857dc77c701797b476a6aada3798e42b591c9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.3MB
                                                                    • SHA256 4d174dc70b901c12c275c8813bf78921b4ca5a087d3558195503206885388abc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.3MB
                                                                    • SHA256 e0cc1f6208301b5f75541cab05a69b1a1e9f5f1a4dff08e5c4ea99ab2c6cfe7c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.2MB
                                                                    • SHA256 61e66dd241b44029c09d9ddd49065a25dc2b99ac2cbb0c88370ea15487c69530
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.1MB
                                                                    • SHA256 0c9cf3807765015ff30ced381051d03e121073f55dbfac49b8d536cae9b54c90
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.1MB
                                                                    • SHA256 34468c28eb311a642e337515161a01e140b382926040a65331590d608ce95ffa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\8466437b5feb390092e49aa9745c732819c7a27ab6ef3a4859c399fab409276f.exe.exe
                                                                    • Size 3.0MB
                                                                    • SHA256 19a89ec774e3025c9bde68530b4a39fb30f6bc52cbbdc7d7239687089110e1d0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Dll.dll
                                                                    • Path C:\Windows\Dll.dll
                                                                    • Size 68KB
                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Logo1_.exe
                                                                    • Path C:\Windows\Logo1_.exe
                                                                    • Size 32KB
                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _desktop.ini
                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                    • Size 9B
                                                                    • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    memory/52-944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/124-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/264-621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/428-1042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/472-895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/484-483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/824-758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/880-591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/888-1070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1000-579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1160-633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1176-645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1204-846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1248-1007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1300-867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1384-657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1632-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1668-902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1696-1049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1732-800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1796-568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1796-552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1840-639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/1912-806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2024-523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2032-930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2064-687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2068-839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2124-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2352-752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2360-1072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2360-1078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2432-776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2440-627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2448-699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2456-550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2484-675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2596-615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2792-832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2876-1014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/2880-764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3000-770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3088-951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3164-916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3312-923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3428-909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3452-716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3620-597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3960-888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/3988-1000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4156-746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4248-853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4280-860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4308-1021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4316-734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4328-993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4356-958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4488-663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4504-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4504-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4532-937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4604-788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4612-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4648-710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4724-541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4736-482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4736-467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4736-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4780-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4788-585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4804-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4860-965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4900-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4904-669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4932-824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4952-473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/4964-740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5100-881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5176-566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5180-609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5252-972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5268-979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5344-573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5380-705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5388-681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5392-1035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5404-1063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5408-782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5424-560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5460-794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5464-603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5512-986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5516-812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5572-874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5632-722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5696-1028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5704-510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5708-499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5756-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5764-693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5796-651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5924-532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5960-818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/5992-102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/6024-728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download

                                                                    memory/6068-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                    Download