Overview

overview

7

Static

static

3

650acbb1f1...0d.exe

windows10-2004-x64

7

650acbb1f1...0d.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 13:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
  • Size 2.7MB
  • Sample261011-q7c1faws2j
  • SHA256 650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F51.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4443.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5508
              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1808
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5092
                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3092
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:212
                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3024
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48E6.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:4720
                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:708
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A0F.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4904
                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5940
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B76.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5600
                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3392
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CAF.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5572
                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2680
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DF7.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1652
                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2944
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2580
                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4216
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4976
                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5068
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1964
                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2508
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53B4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3680
                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5488
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5634.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2444
                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1140
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4808
                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5832
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FBA.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2084
                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4316
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60E3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4660
                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5860
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72C5.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2284
                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3124
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73CF.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5828
                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4608
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7546.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5080
                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1336
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7601.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3808
                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4284
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7834.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4620
                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2872
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2876
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3684
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2724
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5452
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5352
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3376
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AB4.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3136
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:908
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1388
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2528
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2064
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3372
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3624
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4104
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2676
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5916
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4532
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:612
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E9C.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:4828
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4260
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F29.bat
                                                                                                                                          68⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:6036
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3296
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FB5.bat
                                                                                                                                              70⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:260
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4556
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86E9.bat
                                                                                                                                                  72⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5648
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3956
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8795.bat
                                                                                                                                                      74⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5160
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4108
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8831.bat
                                                                                                                                                          76⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4644
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2056
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88BE.bat
                                                                                                                                                              78⤵
                                                                                                                                                                PID:4592
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:1084
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1848
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4252
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:5536
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1708
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AD1.bat
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:2888
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:1996
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                                                                                86⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:5088
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                  87⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:6112
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                    88⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3948
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                      89⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:360
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C96.bat
                                                                                                                                                                                        90⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:5464
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                          91⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:2848
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                                                                                            92⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:684
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                              93⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:796
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
                                                                                                                                                                                                94⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:1744
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EAA.bat
                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:2532
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9001.bat
                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:2516
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90BD.bat
                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a913A.bat
                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                      PID:2076
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4492
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91D6.bat
                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2760
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9447.bat
                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D4.bat
                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C8.bat
                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:4436
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:784
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9764.bat
                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1096
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99A6.bat
                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A23.bat
                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:1956
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:5908
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4332
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:1020
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DCD.bat
                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe"
                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4900
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            2⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Reads the TCP/IP host and domain name from the registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4884
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4180
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                4⤵
                  PID:4644

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                1
                T1012

                System Information Discovery

                1
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                $$a3F51.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a3F51.bat
                • Size 722B
                • SHA256 1b11ba3a19c0802f4ff9f73cee1a46061dfc488029fb8e42e34ab318dfe4481c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4358.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
                • Size 722B
                • SHA256 bd812134e42a01037a501459b9cb3fef98b916364b142e7c543abf671b16134d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4443.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4443.bat
                • Size 722B
                • SHA256 b2dd31700d8290efc4f4eb81c046d7f7f8fc5396f4dee5c8a1c383a7da2e21f3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a45D9.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a45D9.bat
                • Size 722B
                • SHA256 692e2bfd8b453af351fb3813c03877c3c100d24fca61cd18d88939b486e8cad2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4731.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                • Size 722B
                • SHA256 a530fbf060733a2a69431d90ffbe1e6177fba85b97fd686b8512d85533d2f65d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a48E6.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a48E6.bat
                • Size 722B
                • SHA256 4f5741976f2760459c14b2950cc86b2843bbe5c8e55b32f36363a7fe7ccebd1b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4A0F.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4A0F.bat
                • Size 722B
                • SHA256 e7175092580feaeba861fe9c8ca174dcfd5bed399c351e023bb1f566c6112762
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4B76.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4B76.bat
                • Size 722B
                • SHA256 f07ef3a6da0ca44fea9cf3c99550fed27edd18e6848cb0592535ae760d43285c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4CAF.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4CAF.bat
                • Size 722B
                • SHA256 7956b16402da655b54d0b8f8a677bf0572e2ce3bebab32cb498123b8d5a3fedb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4DF7.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4DF7.bat
                • Size 722B
                • SHA256 cd0f12ad932018c782e7f4a32f19bf8277565c54db2114d35b891d17cd6f4627
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a4F3F.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a4F3F.bat
                • Size 722B
                • SHA256 f8499f0188191c0e80263f54dbecbf7e7e01511c515ae647c4996f8c7a256253
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a50A7.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat
                • Size 722B
                • SHA256 1fcaf8cff017dbcbe6d8f7c033b94533cc2b0728b72a5c67858e4b657a26947b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a52C9.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                • Size 722B
                • SHA256 955626bc8aa1ba08b92ba19d581061b468b8b5f574ad22d541f438906efd0b38
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a53B4.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a53B4.bat
                • Size 722B
                • SHA256 d41fb5ff6756a0d06b1f804f793d7659670e97f4dc2712e639b56f055efa5c8c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a5634.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a5634.bat
                • Size 722B
                • SHA256 e6bf3fd2e03ea034c58681191f0d5fe09fccd0798fb5d722fe3e6c575a41459d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a5E53.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                • Size 722B
                • SHA256 44ba5acbb64acd6062fa8277adcc771a62544eb35c1fcc045a89f1d537ec53d0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a5FBA.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a5FBA.bat
                • Size 722B
                • SHA256 b1a8766e94adf2e8356fc988079f80d87ed646a722976f97c68148dec308be3c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a60E3.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a60E3.bat
                • Size 722B
                • SHA256 39773e11ba65c724ecf4af3e5ba2c8ba93584b6e1179626022f56635361e2dc6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a72C5.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a72C5.bat
                • Size 722B
                • SHA256 e824f9653f079b93c6c6ed9eff3506b38d2760b3a32b8a5f548512a636133672
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a73CF.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a73CF.bat
                • Size 722B
                • SHA256 55b027243a5c28063813fac1280d6c18d1028fb3d68e5b81ddfe6ac9479e5f02
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                $$a7546.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a7546.bat
                • Size 722B
                • SHA256 e6f87a216b1d3b001649b0e8ef869ebc027bd927219c2dc90cafdfbd7afc1122
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.7MB
                • SHA256 70d3c7e2219f08f66209d211660c3150beb62fad0d08d818677b1dbab54d7979
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.6MB
                • SHA256 5fae3a74bed6b7f550486434f5efbdcc9c5fbfcbf12a110ad0f6034720b3cbb8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.1MB
                • SHA256 9e7fd2f56e305a3184e02b4f746688366cab832846db23696d7b29953752aabc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.5MB
                • SHA256 9d4d439251fd59380a1331e589ba27cb75cc9e96825a2f7416056d959b116001
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.5MB
                • SHA256 a27978a62b8f8dc1b2663949effd2cea5f267abfddfadeabc37b86a0be39b5d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.2MB
                • SHA256 2fd5e2b6cd6a0422e45e3af50685729295f7857f748f74f448b5cdc4ed3cd868
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.4MB
                • SHA256 dbd453b0a4c775c92719d3344c3a86280e6143d5afa7a291cdaf730a4d0e30b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.1MB
                • SHA256 413f1ec0bc7ddbd9b1f2cae09db62a6d4cd64f1c0919974f97c2f1e7e560e47a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.4MB
                • SHA256 56ddb5a7dac63a48e08c7b26d4148201bbfe4ca8393b51da98cb11131d5ace1e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.1MB
                • SHA256 1e5b1de05581c089743b13c6f0b0c4347fbc7bf68c58f49f630a1fb832db6b01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.3MB
                • SHA256 1f2a2c934fb4d763793c67b28307d6bf7f8c40048bb9d5da6a5b51e877cba703
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.2MB
                • SHA256 d10569afbec17fc87d89f59a9ac0338ac65304cf2ff60e5ff8dca4d316c682ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.2MB
                • SHA256 5741d81a0a0d99f5b13ef30b3a59a07d0b83826f12cfa8110e935b8b76cf4297
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.6MB
                • SHA256 029c57bf46a3e0c28c4fc3f32ac280e2c6114c3fd1f3998c605e122f3770962b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.6MB
                • SHA256 173e09608368b11e15e2e04b69a4dcba4ee4e6f3468ee12aaa8f4cb581602896
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.5MB
                • SHA256 cbd99f47d3cd0489d973cfacb79657e446a4e1e66fc779a10505f006146197ef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.5MB
                • SHA256 d9641e495497672dcfa969ccf93a1e4fb0cbef2cffcb3f0f00ab19c425e2bf15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.4MB
                • SHA256 90217540d386ede0c87e2954e3ff194a6f6baad41dc0fde62cc83cda2a4ec2bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.3MB
                • SHA256 079a3053a33293e0b9497465e5a70038a333d7ce132b6b9e3cdf9dafc1ef2e53
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\650acbb1f16f2020ceeedaf832584ec2adfde161d06241676ff1a050f6e5e10d.exe.exe
                • Size 2.3MB
                • SHA256 d8274260745e6283a3c4196ca7349949f97e80bbef32631827e70028a12cf698
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Logo1_.exe
                • Path C:\Windows\Logo1_.exe
                • Size 32KB
                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _desktop.ini
                • Path F:\$RECYCLE.BIN\_desktop.ini
                • Size 10B
                • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                • MD5 SHA1 SHA512
                Submit Download

                memory/8-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/360-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/612-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/708-78-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/784-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/796-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/796-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/908-6173-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1020-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1084-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1096-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1140-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1336-5676-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1708-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1744-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1808-44-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1864-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/1996-8386-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2056-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2072-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2380-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2384-35-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2500-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2508-149-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2528-6183-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2680-109-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2680-111-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2760-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2764-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2848-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2864-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2872-6149-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2936-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2944-2488-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/2944-120-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3024-69-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3092-54-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3124-5660-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3296-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3372-6189-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3376-6167-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3392-100-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3684-6155-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/3956-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4104-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4108-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4200-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4216-131-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4252-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4260-6213-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4284-6143-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4316-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4320-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4332-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4340-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4492-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4556-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4608-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4668-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4692-24-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4748-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4864-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4884-3164-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4884-115-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4884-13-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4884-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/4984-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5068-140-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5072-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5072-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5452-6161-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5488-301-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5832-1930-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5860-5651-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5908-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5916-6201-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5940-87-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5980-11-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/5980-0-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/6096-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                Download

                memory/6112-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                Download