Overview

overview

7

Static

static

3

db553a0041...81.exe

windows10-2004-x64

7

db553a0041...81.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 11:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
  • Size 4.5MB
  • Sample261011-nlr65agh62
  • SHA256 db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F6E.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53F2.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3932
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5625.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1568
              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4000
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:6060
                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3708
                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5072
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5324
                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:792
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3860
                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1456
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1112
                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4660
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F4A.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:1032
                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4360
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a711F.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5836
                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3428
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8236.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5328
                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:4332
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:764
                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1736
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2156
                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4248
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3744
                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4428
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4140
                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6008
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5316
                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1864
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2512
                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:948
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a937C.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3260
                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4736
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5036
                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5936
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a986E.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1988
                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4412
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9958.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6000
                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3356
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A23.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5816
                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3464
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3524
                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3008
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BD9.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1332
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4356
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3076
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4268
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6044
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4816
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5252
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5896
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1688
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2256
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04D.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3540
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4440
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA147.bat
                                                                                                                          60⤵
                                                                                                                            PID:5448
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:1176
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA270.bat
                                                                                                                                62⤵
                                                                                                                                  PID:956
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1500
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                                                                                                                                      64⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:3380
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2988
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA426.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:4700
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4900
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4F1.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:932
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3920
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
                                                                                                                                                      70⤵
                                                                                                                                                        PID:5400
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                          71⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:2732
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA697.bat
                                                                                                                                                            72⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:2804
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4864
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                74⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1828
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:1116
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA82D.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1540
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:5768
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4844
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3808
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9E2.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:3440
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4908
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAABD.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:6136
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:2884
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB88.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:6016
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:5968
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:3724
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4576
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5288
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADEA.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                    PID:5708
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4948
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA5.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5516
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB03B.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB28D.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5360
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB368.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB423.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:3432
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4FE.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB685.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3604
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3580
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1388
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:1344
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBA5.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                            PID:6024
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC61.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:3584
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:5224
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE1.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:760
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:3064
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                              PID:3488
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:5204
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2AA.bat
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:1704
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:1028
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC385.bat
                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4008
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC460.bat
                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4FC.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC673.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4120
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DA.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1324
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6A.bat
                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD008.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD807.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD95F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDECD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE073.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE10F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE248.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE380.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE40D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE49A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE536.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE65F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3796
                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                          24⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:2380
                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                            25⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:6036
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                              26⤵
                                                                                                                                                                                PID:2376
                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:5808
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                  3⤵
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:4740
                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                    4⤵
                                                                                                                                      PID:3868
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 996
                                                                                                                                    3⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:2372
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5808 -ip 5808
                                                                                                                                1⤵
                                                                                                                                  PID:3476

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      $$a4F6E.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4F6E.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 68b22f8bf0e156b52d6c5d9861eadcc06cfb77425f60869387797297277972ac
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a53F2.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a53F2.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 b54047e50e428c2226ef17b927769949107af585c0c25f350b69b3c9649276b2
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a5625.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5625.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 36ff6607a8b75d8bb99d58686f5fd89b11f98e08228103e56f3bdf6fbdcecd82
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a5922.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 977160afb1cfd0635cedbfca8700e5e7a4a09d1db11398db3eba4e3a37bdf096
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a5C4F.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 a3408a7358b141094da08bd34fffbe6f17d6627dd0ffc2bc428c9fbec623d541
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a5F2D.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 d43c4c6b6993bf86bb7b59a537f6ff4a09b4948efb9524a4bf01ef71c09e1785
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a61DD.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 838fd17abf5b001d014774aef975ac5c244ed611c3b00a43af8cf53bbd820bd1
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a6529.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 e4202c75fd9c4b349765ec8d1f275c81b9160fe6e116b6ceba13021ede936733
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a6F4A.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6F4A.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 66f0d47aa36bc5016ebfcf43ca388a1ba09830d9480b1aac8971e7d004b1adbd
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a711F.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a711F.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 49909389aab138997c13bf5542937a20f64821e2eaace6d03dfe44ee3c4ac49c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a8236.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8236.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 b35d6655ee4051cb67923e02c1fde2aa05fcd515550e47b7fd60ea22b631b55c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a840B.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 59a837397d115de6ca0835dae5ecc808773f78786c88c72223b38ad6c68ac73f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a869B.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a869B.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 3790362e2688fbe590289a595e76cb529c27e89d50033690ff1110da07b281c7
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a88FC.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 bc4db1e001472b867e8631a1f616862b9ade66db71b372c60ed9e41ed2fd35a0
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a8C0A.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 dccdadf2d55ebf4e86736dbb2f237373b4138e46fc1b79c6227a8af047091c0d
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a8E9A.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 589f24a00fdc1c345e287e14279a025141186844b5672ee9db451499637625cb
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a910B.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 103ec07e41194674a1149b411c0e376745c947bdf0a36f7340c8fa9aca6db067
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      $$a937C.bat
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a937C.bat
                                                                                                                                      • Size 722B
                                                                                                                                      • SHA256 f1ba4c1cd3e1aeea4e956907caaa3c8b5f9e22daca34e77100170b2cad91bbc8
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 e15cbe94aca50ab77056408522dcef619fe74192971744a9949d85d8ab61135c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 78fd0dc86a9a95149b658347fb3c3de5460701d8df9cb23a2fb7b0245141fe25
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 09ba620142e0922a7aa4967654afdf10bb18b9e5d084e68e4374fda73d400299
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 dace129a821a4ad93f05cc3b7447e3f1fcf29b9e26462b47c0b3caa580e6bafc
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 edf0592a57b0814fd4f3096e4bf0a6a99c6517388874d398e4e08660e3ae9f66
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 534ae9e766e500e868aa1f7c17d6e1be1ef6e19a7d3ecd6e654e688f6176cc39
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.5MB
                                                                                                                                      • SHA256 7e574e6749460e6b30683d39fb6c37717f66d984eb007393a0bec8940089f38f
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 03e73012de40f9538c533b574b6c1689c32661d63ae96ad5d9ce5aaa229fb8dc
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 a781d0d7b2e937df1e0b05c3c304815c91a45eb2bbaec2714844667dd1905df6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.2MB
                                                                                                                                      • SHA256 1af742f008b528ca3835c5e5513de5cc6e3f86b1818f8999b403a8cb07958a62
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 e21b37350ca2bfd67117f9755a4b16f6b2a733fb18f9521fb27680c89f3746a5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.4MB
                                                                                                                                      • SHA256 b81d1e93e61a643b620e7d7f8dbf5a66c2577e222f9ed53d6253aa302983b1b5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 edb552c1a2c4f36734201437a53c28f436794b153a0aafa6f2b7c15ccb776950
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 7695393d133eb67c2eec8136cd04414e39b0e31facccf202bf00b9bd7d2746bf
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.3MB
                                                                                                                                      • SHA256 e07e1550570866cfaa88c84e244b0d8218940d9ee91de768cea3308c76e40a50
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.1MB
                                                                                                                                      • SHA256 dad9f983dfbaf06e86ac1649f385198b60538aab185c98ef17e4bfedf2acbca6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 4.0MB
                                                                                                                                      • SHA256 bb1b503fe8f17d720d9161a22d142f22b7f5de78b2ac355761c30f8a7682fc5b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\db553a004141ac58c8651aad39e29d15d2e2ba23224624cea7b8520022ca4181.exe.exe
                                                                                                                                      • Size 3.9MB
                                                                                                                                      • SHA256 d97a70a9a55979b3f32307770f3d718de2035ebcd1d2be444e133bd04fe502bb
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Dll.dll
                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                      • Size 68KB
                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Logo1_.exe
                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                      • Size 32KB
                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _desktop.ini
                                                                                                                                      • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                      • Size 10B
                                                                                                                                      • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                      Submit Download

                                                                                                                                      memory/464-5489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/728-5391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/792-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/948-4827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/960-5131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1028-5180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1116-4951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1164-5145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1176-4909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1180-5117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1264-5496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1324-5229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1344-5084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1456-116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1500-4915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1512-5475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1516-5412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1604-5060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1616-5278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1648-4994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1716-5292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1736-4778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1864-4818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1960-5215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1972-5173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2108-5327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2136-5554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2136-5560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2168-5222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2180-5257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2184-5024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2256-4897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2276-5370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2316-5482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2352-5405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2380-4850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2380-4971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2424-5433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2528-5447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2532-5271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2732-4939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2884-4976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2940-5264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2988-4921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3008-4867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3064-5152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3172-5349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3184-5042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3216-5377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3236-5072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3292-5194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3356-4855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3376-5250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3408-5342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3424-5208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3428-4751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3432-5048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3464-4861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3484-5018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3516-5468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3580-5066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3628-5138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3704-5078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3808-4963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3920-4933-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3932-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4000-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4008-5187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4104-5419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4116-5461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4124-5054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4188-5090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4192-5545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4248-4787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4268-4879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4292-5552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4296-5103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4332-4767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4344-5356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4356-4873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4360-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4380-5517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4392-5236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4412-4848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4428-4800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4432-5201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4436-5285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4440-4903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4508-5159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4528-5363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4576-4988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4600-5320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4628-5426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4660-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4680-5531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4736-4836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4816-4885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4824-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4840-5299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4864-4945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4892-5335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4900-4927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4908-4969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4948-5000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5068-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5068-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5072-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5080-5306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5084-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5132-5006-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5204-5166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5224-5124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5248-5440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5276-5384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5284-5538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5348-5096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5360-5036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5484-5030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5516-5012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5720-5313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5744-5398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5768-4957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5792-5524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5804-5243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5808-1852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5808-2890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5808-4750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5808-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5876-5454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5896-4891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5936-4842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5948-5510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/5968-4982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6008-4809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6020-5503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/6024-5110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                      Download