Overview

overview

7

Static

static

3

a2512cf4fe...47.exe

windows10-2004-x64

7

a2512cf4fe...47.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 13:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
  • Size 4.0MB
  • Sample261011-qdmb1sav3x
  • SHA256 a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5368
          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:432
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3C6.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3564
              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3656
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3120
                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4972
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5856
                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4280
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1508
                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1480
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD1C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5964
                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3532
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4772
                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2400
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4836
                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4716
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC411.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4940
                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1152
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1500
                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of WriteProcessMemory
                                                PID:1520
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5352
                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5656
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2132
                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4576
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3016
                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3252
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:8
                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4468
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:256
                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4636
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD910.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5432
                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3976
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA68.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4988
                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4140
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:6128
                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5884
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDE3.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2544
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4996
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2172
                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5512
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFA8.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3384
                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1932
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE073.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:980
                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2448
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2940
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1212
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EA.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5636
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5532
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2B5.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2512
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:6020
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1772
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4876
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE45B.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2912
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:876
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE536.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4752
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1352
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                          60⤵
                                                                                                                            PID:2192
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:3368
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE70B.bat
                                                                                                                                62⤵
                                                                                                                                  PID:2100
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:2932
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7E5.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:1472
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4528
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                                                                                                            66⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4928
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4188
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE94D.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:1828
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:2168
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA18.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2648
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4008
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAF3.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2020
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4808
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBAE.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:4116
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:5344
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6A.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:3216
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:5496
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED25.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4668
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2428
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDF0.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:5652
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:3664
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEAC.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1912
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:2896
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF58.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4420
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:708
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF023.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:996
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2636
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:1012
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3652
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1F7.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3448
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2C3.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1924
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF37E.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF42A.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:3296
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4D6.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:3824
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:2272
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5C0.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67C.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF747.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF812.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8BE.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95A.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:5504
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9F6.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAB2.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2236
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2188
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:236
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC19.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:3648
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCE4.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDA0.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE5B.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1540
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2376
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF36.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF2.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5544
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:2952
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a205.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E0.bat
                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5744
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4580
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E9.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1392
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a531.bat
                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B8.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4064
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC.bat
                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a958.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1552
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F4.bat
                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1236
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:784
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE.bat
                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:984
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5012
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7B.bat
                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:2036
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC07.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:2660
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC94.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1380
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:360
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF05.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a101E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1203.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a128F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a134B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1406.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a153F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1658.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1771.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a180D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1956.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a200C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:668
                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                        24⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Enumerates connected drives
                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:3388
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                          25⤵
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:3040
                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                            26⤵
                                                                                                                                              PID:4376
                                                                                            • C:\Windows\Logo1_.exe
                                                                                              C:\Windows\Logo1_.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Enumerates connected drives
                                                                                              • Drops file in Program Files directory
                                                                                              • Drops file in Windows directory
                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4036
                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2760
                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                  4⤵
                                                                                                    PID:4988
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1000
                                                                                                  3⤵
                                                                                                  • Program crash
                                                                                                  PID:3672
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4036 -ip 4036
                                                                                              1⤵
                                                                                                PID:1744
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                1⤵
                                                                                                  PID:5752

                                                                                                Network

                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      $$aACFF.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 bfda1999c75fd9ba82b014e7fc660ececd8ff2c72c250376286c76145410dc23
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aB135.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 97eacae530811cc9e247ac2d0c27150ff419321f434df05c583fc3324a923333
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aB3C6.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB3C6.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 24139661baf23e5e1b5b95b4fb33a11ef60037b908d474bf1fc3444da36f568e
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aB5E8.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 c621d40f5e1673a386c680218fc31ba018dcc09c1895908e7851fcf2a2fba15a
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aB84A.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB84A.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 0fe9d2ad3fc216fe0a453e1c0232033808fd80c078e77f99346dee5c120d0723
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aBADA.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 a6c193f3f774c0473f4db72c7f2d845daf0025e0c4632f81655e1c1295c49156
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aBD1C.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBD1C.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 283824a1f481203afaa1af2c1d847069e52148d0fed2fbe142286d1e334869d2
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aBF7E.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBF7E.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 0e6ff352dcc89e004b6a184d4652f6d277283b932ce90c51736d2ffc766aa4e4
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aC133.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 36bb57106b019a39ae1d67d77622c22cc5648e5bd0a9720ae0111311015182ad
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aC411.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC411.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 1eea5b59bc86cece11b445dac095ff1db17f7ec9413f2ba84b3d8455a11e7adc
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aC9CE.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 704ed999809f0878c6b1ac09981d817c69d34f6ab8fe6c60ebd16bccc1e5788a
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aCD87.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 5c3789c792053c54cba1501b9bd17dc87eb33c49726d1a0ca93602c256103daa
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD027.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 2c90a21425bb3d58d1dc6704f0e517cdb400206fa240921b393b13c7d4643908
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD334.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 fa96c82246ce91f5599015fa22764822eeb1309701615128e41d2bb17d172677
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD43E.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 e76c90ce76f34e47e53b5818e6788c6c0fb7ea18300e2d468941e3b462c139c1
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD642.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 80d5814e6ba67e3e8b1e5fa76e80e63997e2827cf707326e3295a2e4031f37fc
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD910.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD910.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 1f274f8cf5eabcb8b17fa1a7dbafeb2fc908d1abf925fdd7751d758861ec09d4
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aDA68.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDA68.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 7f4a96ba67ec38c8423aba17c44ff3668eb76c3482adece3d5e8e6ee9ee9a2b7
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 4.0MB
                                                                                                      • SHA256 1dfd930557df8991561885fe168ae419621ed2309dd62834fc68664c889b40fd
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.9MB
                                                                                                      • SHA256 990938f4fefabf1813600050232b2492b1ae1d7999fe9486e06647b4d39fb4e9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.9MB
                                                                                                      • SHA256 27b04455a9117c944b68922bc21f399d2fdf95374686b58975c16e307bb3bd88
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.8MB
                                                                                                      • SHA256 03a5d9ef975cffbcd6bdde7c898950c00a62142c009abf4a640c1143ddbe7aa9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.7MB
                                                                                                      • SHA256 e6fc8d1da970948144a07b972e3c8e8affce8219e4ae6eaf557365d84a06679f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.7MB
                                                                                                      • SHA256 b0104615170e59921040da51634d2d5520b6018eb2b370f11476308ef1c9f4af
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.6MB
                                                                                                      • SHA256 da9eace4b5674f16d4d1c5533fcd4450278d7285205c4c482ff691a7262af9cd
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.6MB
                                                                                                      • SHA256 58cf2d8c278651f9bcba4e114fe08bab64c172ce69871e8baeaec9d1f3f986db
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.6MB
                                                                                                      • SHA256 39ad3182c1636d55206f8d4c1c451997ec7d370386434f6195eb5c2439d2d027
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.5MB
                                                                                                      • SHA256 774654efa3d8bae5e5e810bf5ea63da597a63d23259e91047e4bec2620a1d939
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.5MB
                                                                                                      • SHA256 4ddc8341c647ae04dbf4839bf12625c0e40bf47ab1fa81333ecfb1872f6f5a8d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.5MB
                                                                                                      • SHA256 7db556befea763963e418ede3a6108ac211701f5b9c1ad1c215f58191435d69c
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.4MB
                                                                                                      • SHA256 a65688dfd20b524895dbab1c8b339c33331e2045a941b3224116d8532dda8dae
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 4.0MB
                                                                                                      • SHA256 5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.9MB
                                                                                                      • SHA256 120e6b416bd3fd3240974a493371266bdd5b49f7d35059c3b89ab746d7d021f9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.8MB
                                                                                                      • SHA256 7fc418a6a695ad3d13d3d76860d750a4e81716fe76ef976b94b887c6c542fdfa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.8MB
                                                                                                      • SHA256 c535287e825dff704574788d6cadef8423d6470d4592ae9a0d616d345ed0f5c7
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\a2512cf4fed5ce79038b44d754821ba87be48ac0cfae251a5f937d97925a4147.exe.exe
                                                                                                      • Size 3.7MB
                                                                                                      • SHA256 480eea22f2a150c131954ce0f176969328a4be31f348a356895078b1fb11dabb
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Dll.dll
                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                      • Size 68KB
                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Logo1_.exe
                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                      • Size 32KB
                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      _desktop.ini
                                                                                                      • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                      • Size 10B
                                                                                                      • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      memory/236-902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/432-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/564-1212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/708-805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/784-1037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/876-721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1020-1065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1036-1205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1152-572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1160-896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1176-1156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1188-1121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1212-696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1352-727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1384-835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1392-974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1480-83-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1520-592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1572-1198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1728-1219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1932-684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2168-757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2204-854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2272-847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2320-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2376-926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2400-103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2428-787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2448-690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2500-932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2576-995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2636-811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2660-1058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2764-1170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2772-914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2896-799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2900-1030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2904-1023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2932-739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2952-946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3052-953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3092-1184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3132-1240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3212-1149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3252-621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3260-1107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3296-841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3340-878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3368-733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3388-587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3388-673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3388-849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3392-1271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3392-1277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3432-866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3532-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3568-1086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3652-817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3656-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3664-793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3708-1128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3960-1100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3976-650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4008-763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4036-401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4036-577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4036-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4056-860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4064-1009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4140-716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4140-659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4160-890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4188-751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4200-1262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4276-908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4280-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4356-1093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4372-1269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4468-632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4528-745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4576-612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4580-967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4588-960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4596-823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4624-1226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4636-641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4716-112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4736-872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4764-1016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4808-769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4816-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4816-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4824-1051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4876-714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4972-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4996-671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5012-1044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5024-1163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5064-1114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5144-1177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5308-1233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5344-775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5496-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5504-884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5508-988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5512-678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5532-702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5544-939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5564-829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5640-1255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5656-601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5792-981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5848-1072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5884-665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5888-1142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6020-708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6032-920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6048-1191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6056-1248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6092-1002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6108-1135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6136-1079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download