Overview

overview

7

Static

static

3

489b8b73b2...47.exe

windows10-2004-x64

7

489b8b73b2...47.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
  • Size 4.5MB
  • Sample261011-krpreagy7t
  • SHA256 489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5988
          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4712
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1296
              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:6040
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4220
                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1688
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3900
                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3564
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1248
                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1308
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:6048
                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1912
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FD0.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2800
                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2324
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3356
                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3924
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:1328
                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2052
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADDA.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5580
                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2332
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4628
                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1120
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC143.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3928
                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4156
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5848
                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5888
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5996
                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1168
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5060
                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4832
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1848
                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3788
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3944
                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1060
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5256
                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1364
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1468
                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1924
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2284
                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4212
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFE6.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3816
                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:6076
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3300
                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4148
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1052
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5036
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE286.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6100
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3652
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1860
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5420
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3756
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5152
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE536.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4912
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4512
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE611.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3892
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3140
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6BC.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4836
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1624
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE768.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4984
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3584
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE853.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:2640
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4292
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE92D.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4072
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4608
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA27.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2004
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3772
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB02.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4696
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5808
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBED.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:2156
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:244
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5884
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:932
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF0.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3536
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:1652
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDB.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4672
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:5388
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFB5.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:2492
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:568
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF071.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:4616
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:6072
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF14C.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2776
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5020
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF217.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:3204
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2680
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:5100
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:1384
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF38E.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                                PID:2508
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1964
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF514.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5DF.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1876
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6CA.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7A5.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:3112
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF870.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF90C.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9C7.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2008
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA83.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1800
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC29.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD04.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDCF.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                            PID:5040
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:3552
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEA9.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:476
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF75.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                            PID:848
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12A.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:1432
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C6.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                      PID:3880
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a272.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                              PID:5240
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33D.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                  PID:5124
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E3.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:3372
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58F.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:4940
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B.bat
                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                        PID:1504
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E7.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A2.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DB.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2408
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a996.bat
                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                      PID:976
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2136
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2616
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4136
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2D.bat
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5656
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:2160
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2.bat
                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:2112
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3572
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:948
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF05.bat
                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5232
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1128.bat
                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1203.bat
                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a129F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a136A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1425.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:264
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1762.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:440
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1956.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ED4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a207A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2126.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a223F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a256B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a277F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4440
                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                            2⤵
                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:3260
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                              3⤵
                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                              PID:1096
                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                4⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4512

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Reconnaissance

                                                                                                                                              Resource Development

                                                                                                                                              Initial Access

                                                                                                                                              Execution

                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                              1
                                                                                                                                              T1059

                                                                                                                                              Windows Command Shell

                                                                                                                                              1
                                                                                                                                              T1059.003

                                                                                                                                              Persistence

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Privilege Escalation

                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                              1
                                                                                                                                              T1547

                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                              1
                                                                                                                                              T1547.001

                                                                                                                                              Defense Evasion

                                                                                                                                              Credential Access

                                                                                                                                              Credentials from Password Stores

                                                                                                                                              1
                                                                                                                                              T1555

                                                                                                                                              Credentials from Web Browsers

                                                                                                                                              1
                                                                                                                                              T1555.003

                                                                                                                                              Unsecured Credentials

                                                                                                                                              1
                                                                                                                                              T1552

                                                                                                                                              Credentials In Files

                                                                                                                                              1
                                                                                                                                              T1552.001

                                                                                                                                              Discovery

                                                                                                                                              Peripheral Device Discovery

                                                                                                                                              1
                                                                                                                                              T1120

                                                                                                                                              Query Registry

                                                                                                                                              1
                                                                                                                                              T1012

                                                                                                                                              System Information Discovery

                                                                                                                                              1
                                                                                                                                              T1082

                                                                                                                                              System Location Discovery

                                                                                                                                              1
                                                                                                                                              T1614

                                                                                                                                              System Language Discovery

                                                                                                                                              1
                                                                                                                                              T1614.001

                                                                                                                                              System Network Configuration Discovery

                                                                                                                                              1
                                                                                                                                              T1016

                                                                                                                                              Lateral Movement

                                                                                                                                              Collection

                                                                                                                                              Data from Local System

                                                                                                                                              1
                                                                                                                                              T1005

                                                                                                                                              Command and Control

                                                                                                                                              Exfiltration

                                                                                                                                              Impact

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              $$a8DCF.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 0ef2a204caf699538f788650908c9e483578ab43892fd6d4612b8e1d807d3923
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a908E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 77ad9de5e78f9630b4933921ab51ba6098ae76d9dc465ded3c1ab9064a62dcbb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a935D.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a935D.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ec4a9ad58772bab0d2ff0f9546d1e77636b71d26bb790e32508c619e94fd81a1
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a961C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 930a9e789637604205791f98aa39fcc63f4583f209b28c805cc9b573322db77d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a984E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 09e20dc8d6b16d3c54994cdf9386973080a5f947b63de6748ecb7d3284abc5c6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9AFE.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 24684e3e0988af9bb3805993e505e5a98f4a7a386248ad94e4d1439fd31669c7
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9D7E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 92f0b7cd93377a54a9f7c367fe6410d995dc8b732d7facf25ab10bfcf2e4064a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a9FD0.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9FD0.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 4982b08c0ef0d00a1c55fa4e5a075e3aaa344b687a2bb8acf323c2de0280d63d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aA2FD.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 4bf93d0e93ee43e7a7a09ccf1ff9b0cfecbf383e85c23efa22d5994e92c89f1c
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aABD6.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aABD6.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 c6fb073d2365c65302112b6923a6685619d4b39c846f5569c4ae9821dd5175ec
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aADDA.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aADDA.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 390287f2d5040d3ab3680767837acbca1a300d66965d9efa7b7c467daaa780ab
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aBEB2.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 73eb5c6cd7c5bcbd68d23b4488d5392e19a67ce387fc346272ba9b7523cf57b8
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aC143.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC143.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 53c98ffb16ab5e8b288ba88e2164d3bff87def726f6989aff18e02c47b6089ff
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aC3B4.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B4.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 10336a6995deeba47da035a41ec7033d408647112ab7d62ce5160daae4adce8b
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aC896.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 72a5e9714741e0c7a83049f628c8fe15c87d30b6cbc37cd57b8b8c2d3a21005d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aCA99.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 43e79f1f9d7aa435fce9ca7d960d0227a4b9c52b582ffd1709ddcf9f2ce2ca3d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aCD78.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 94baf8c69dcfa140539cf77e4e2b11970cb524f24cafdafe8874f485d7818690
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aCF6C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 f1ce4ccd4bbe866482615d4d9a19b5658abbb9f6fab1d016dfbd27a012448f3f
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aD96E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 8914c45a6665ee91cf270a0be5227fe80c26c6c01b05a0a23c89b86ba6e6cd9f
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aDAF5.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 c6682ccaba53f691fff386995ad8bb9f04f5b021d635eac2fef04c59e5bfebcb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aDD66.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                                                                              • Size 722B
                                                                                                                                              • SHA256 ad36bdf652a4dcdd51a1fe907ad21bf5275cfb72b0090e4c89646595d20521d4
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 2d44c34629f8f2128921d66c256300de242ab410462b1dfe1e79cb915db5aa8c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 562828f2779ec2b524a23a23083fabe90ca53361ca9f0649cd0276ec597b9634
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 3.9MB
                                                                                                                                              • SHA256 fc7b30f82f7feb8d02d2d1bb3cc0d477cc8ba87d96f61b9a1898ab7faaab8fbd
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 bbabdefefeb9c97e457e8e1c8b005874e0b848ef7d836e21ffef61ff676bee6c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 d2389e1510684575efe83836755ad923803e61ee83ac4aa198fb55d1155433a5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 58323afa376d543e3f75ee3590c628d172dc4922b43d78fcc80df38c08e49abd
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 e934a4f54a9be3784be6476f23cdd3ed3c9910a72fed5137b4a6adb7432e4850
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.0MB
                                                                                                                                              • SHA256 a5ade1a531190a16fd72261e9417a74e14ce695d0fd7aa2bf60317d935739816
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 3.9MB
                                                                                                                                              • SHA256 2fa096ac65647dd361791f26aad8f3d1f7d4ea5473c4cf65dd46a1b317946d2e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 1107217054fd291d92dff3a42839fc83ca453e7a7e32d455293fa03466ae3fbf
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 f23043e51b5fbf3cb978d514d920ce3ac2e02b6206ae282d93e7bcbcdc87182e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 a3529b8e1197d62352a5ced5fb3b93c505e098cdb178bf3c6a3c0fc515251598
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 b56f578395702ddc8663a21fb28916385b66ea10d2881cc4db81b968f28b6f3e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 d334ed66617fa53e373904e9eedde75bb925dba8940cf371fb5a8e9eb030774d
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 7a6948e8d40e62ecefd36f50d99c3d15644fd85a2760fc8300c824b2850be4c7
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 cfd5a31b2da15a0033c30465ef25c4d9236e366dce1ffa663577ddee8f42458d
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 d504cbab3a7c28a1735d2ed8b4ba2747d054748ace8bcb46864c9f449c4b7b3c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 4f3df01a6b0b5cbfd65b7ab37efc7a7d45cab38db2f0ff14981a03131f1d3468
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 703d276ea8a9296df48127b0032582a297b19aec847ab0077377cc7699a7460a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\489b8b73b2490f36472c56b8e62d35d52ea0df31dc6b8229073e16131bf77e47.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 4e4171aa6031c290a465a14aa6bc29fde26c14fdcef0fa8a1be2541cc0d2ad96
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Logo1_.exe
                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                              • Size 32KB
                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              _desktop.ini
                                                                                                                                              • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                              • Size 10B
                                                                                                                                              • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              memory/204-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/244-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/300-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/480-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/568-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/932-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1036-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1060-8121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1120-5597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1136-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1168-6085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1212-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1220-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1224-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1308-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1364-8130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1368-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1384-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1432-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1516-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1568-8794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1624-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1652-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1684-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1688-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1804-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1876-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1912-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1924-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1964-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1984-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2008-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2052-1875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2112-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2136-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2160-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2232-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2320-8845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2324-126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2332-5211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2368-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2384-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2408-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2484-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2680-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2780-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2796-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3020-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3060-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3140-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3172-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3192-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3232-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3260-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3260-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3260-1656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3260-3077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3372-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3552-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3564-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3572-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3576-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3584-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3652-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3676-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3692-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3772-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3788-6107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3924-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4136-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4148-8161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4156-5606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4212-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4292-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4320-8838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4360-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4384-8717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4408-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4416-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4432-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4512-8191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4524-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4548-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4576-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4596-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4608-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4664-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4712-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4764-8703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4788-8773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4804-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4804-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4820-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4832-6098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4900-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4940-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4952-8787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4976-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4992-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5012-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5012-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5020-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5036-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5076-8766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5136-8724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5152-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5168-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5232-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5236-8745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5240-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5332-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5352-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5360-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5388-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5392-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5412-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5420-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5472-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5540-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5544-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5576-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5612-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5656-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5744-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5752-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5808-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5820-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5820-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5864-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5888-6076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5896-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6008-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6040-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6072-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6076-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6084-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download