Overview

overview

7

Static

static

3

5514b1d915...dd.exe

windows10-2004-x64

7

5514b1d915...dd.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
  • Size 4.0MB
  • Sample261011-rvhwlaszas
  • SHA256 5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3937.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CD0.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5416
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5340
              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5664
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4145.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3696
                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4124
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2520
                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4716
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a455C.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5100
                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5836
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2552
                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5640
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4954.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5632
                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2208
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B09.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1696
                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5528
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CED.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:2000
                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5952
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ED2.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5336
                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4468
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5625.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:996
                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3564
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59CE.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3800
                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3320
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6140
                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4484
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CE9.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1568
                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5688
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB8.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1804
                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4112
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7267.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4896
                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4924
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6092
                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2288
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2404
                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5024
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5940
                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2408
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3884
                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3452
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1948
                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5572
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1648
                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4472
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E0.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:356
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6052
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1304
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6116
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2548
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5860
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1252
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4180
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2796
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4600
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1928
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2024
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:708
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3548
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CE4.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1168
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:4196
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3080
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:1032
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:1172
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:1544
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F94.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:1352
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4068
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:6072
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:860
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:256
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:292
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9234.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5420
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:4648
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a931E.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:892
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1820
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3616
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:3672
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9503.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:596
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3020
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:5712
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:5412
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2292
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2640
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9783.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5008
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2312
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:2432
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4772
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:4564
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:1824
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3176
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2852
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4452
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BAA.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:2140
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:4052
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:5616
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3A.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5248
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FC1.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA09B.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA176.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:480
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA241.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:2744
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA31C.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3D7.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:2812
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1260
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA60A.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6C5.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85C.bat
                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:1000
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:3824
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA927.bat
                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat
                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAABD.bat
                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                PID:3840
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                        PID:5896
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE09.bat
                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:5356
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAED4.bat
                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:1332
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:1764
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06A.bat
                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB135.bat
                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:1520
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1860
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A6.bat
                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:844
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2376
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB50E.bat
                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                            PID:704
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5936
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:6128
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB665.bat
                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2504
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:2652
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB79E.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4908
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:3224
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A2.bat
                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC848.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5048
                                                                    • C:\Windows\Logo1_.exe
                                                                      C:\Windows\Logo1_.exe
                                                                      2⤵
                                                                      • Creates a file in the Startup directory
                                                                      • Executes dropped EXE
                                                                      • Enumerates connected drives
                                                                      • Drops file in Program Files directory
                                                                      • Drops file in Windows directory
                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1220
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        net stop "Kingsoft AntiVirus Service"
                                                                        3⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2240
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                          4⤵
                                                                            PID:6028

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Command and Scripting Interpreter

                                                                          1
                                                                          T1059

                                                                          Windows Command Shell

                                                                          1
                                                                          T1059.003

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Defense Evasion

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          1
                                                                          T1552

                                                                          Credentials In Files

                                                                          1
                                                                          T1552.001

                                                                          Discovery

                                                                          Peripheral Device Discovery

                                                                          1
                                                                          T1120

                                                                          Query Registry

                                                                          1
                                                                          T1012

                                                                          System Information Discovery

                                                                          1
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          System Network Configuration Discovery

                                                                          1
                                                                          T1016

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          1
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          $$a3937.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3937.bat
                                                                          • Size 722B
                                                                          • SHA256 edf1eb9e503bca5f2af935d893a6f0fd763731fc7afcd3f6ef010c17e42bdf49
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a3CD0.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3CD0.bat
                                                                          • Size 722B
                                                                          • SHA256 b37712a471f40757023ac85f0ff86b1e9b4a7552125c3b800e27cf7645b0ef00
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a3F32.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                                                          • Size 722B
                                                                          • SHA256 710e2e1b50a124e6c13297935a94cb2649753251b31c3d077734d8e7952eaf3a
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4145.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4145.bat
                                                                          • Size 722B
                                                                          • SHA256 3f93d6b11658adac208a3a04ed44d7323e44aa3ba2f4edd49ba18e56c70e129f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4358.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
                                                                          • Size 722B
                                                                          • SHA256 3b98c9b1d2cda862c64ed0d9b177645a5f71cb013d13d846508cf423c938f270
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a455C.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a455C.bat
                                                                          • Size 722B
                                                                          • SHA256 4247297b20d2186234f8031cfae4d5ce60ffef1704966814c3d898892586ba9d
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4740.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                          • Size 722B
                                                                          • SHA256 03ef1280104d7568406689f62c69c012bbc65e9d32a69a3d902179bac8f9fb91
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4954.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4954.bat
                                                                          • Size 722B
                                                                          • SHA256 8e6f4bb9bbaeb5cd78ac39e74600ed6fa75485584c28bd14803bb7d2560318bc
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4B09.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4B09.bat
                                                                          • Size 722B
                                                                          • SHA256 080e7294c21de0767de5b0ce06e23eb39cd4d7e4feed1a0e689a57a10a403580
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4CED.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4CED.bat
                                                                          • Size 722B
                                                                          • SHA256 5110d408f11319e971b46aa7283c505c71cf8fd86fc92e63953073540b903f4f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a4ED2.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4ED2.bat
                                                                          • Size 722B
                                                                          • SHA256 ab68ecd059afe602f4d89bfe3321305f27c4395d50b32b38e9f679e99e77abb8
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5625.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5625.bat
                                                                          • Size 722B
                                                                          • SHA256 b83c9ae67562a83bfb2a51c23aece4a1e42c3cf1f18b45917566ef0e0ecc740f
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a59CE.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a59CE.bat
                                                                          • Size 722B
                                                                          • SHA256 03593265d39fa4eca3a291522674750c0c8f076230b7fc42522c8ea56a76764b
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a5BC2.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5BC2.bat
                                                                          • Size 722B
                                                                          • SHA256 9c329e16496204802c4f1e69bc96bdf4546b93a85235484838c493b7eb79ad1c
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a6CE9.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6CE9.bat
                                                                          • Size 722B
                                                                          • SHA256 1a41e6b4f42f097b3713782ef6ff7d1eb73c0ebe1b84697f58870d40b2c3f3d0
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a6FB8.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6FB8.bat
                                                                          • Size 722B
                                                                          • SHA256 e822063170caac3df532fbaf5dd56dc1f9b135c87afc5654ecd1667e23d97c5b
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a7267.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7267.bat
                                                                          • Size 722B
                                                                          • SHA256 a1e740089889c6da7ec5b70e8c5be97958432e3c780bf0ea3c1e1d5cf961e4d4
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a768E.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                          • Size 722B
                                                                          • SHA256 e52f9f072b3d96cb49190de8c63db6d1b7cd4895b747219eb867e23a1b66c5f2
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a7872.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                          • Size 722B
                                                                          • SHA256 f5a7fd70af83afbfc9983c8e5a4a27bea6d7a881126fe3b7d4719befeb6659d3
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a79F9.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
                                                                          • Size 722B
                                                                          • SHA256 5d973ccdeeeb77289cb0dd97b992d6c5c2ee7323ff8312eaab58ede305a43d4c
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          $$a7BDD.bat
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                          • Size 722B
                                                                          • SHA256 e8329f168f1b6c14f9b4e6a0db4df482004b04f34a56b725a424c6bc5762ed5c
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.5MB
                                                                          • SHA256 7db556befea763963e418ede3a6108ac211701f5b9c1ad1c215f58191435d69c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.4MB
                                                                          • SHA256 b9a565fd6f38132612365fdd0267fa23d8db535b5caecd20644016b3c83c3db6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.4MB
                                                                          • SHA256 60f0099e37b5a4e7fafec1d633d0d24c9603d89ba20f3ab9ad4233a457332c81
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.3MB
                                                                          • SHA256 833f427ba6d63458ec53c14fa6897f020abfbecf862641b49d178924263a47c9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.3MB
                                                                          • SHA256 d22bbcdbdb0f4f8e9757bc4d8d5a53e537dba51ad1d477de3edec1d0d8493fc6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.6MB
                                                                          • SHA256 39ad3182c1636d55206f8d4c1c451997ec7d370386434f6195eb5c2439d2d027
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.5MB
                                                                          • SHA256 4ddc8341c647ae04dbf4839bf12625c0e40bf47ab1fa81333ecfb1872f6f5a8d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.7MB
                                                                          • SHA256 e6fc8d1da970948144a07b972e3c8e8affce8219e4ae6eaf557365d84a06679f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.4MB
                                                                          • SHA256 a65688dfd20b524895dbab1c8b339c33331e2045a941b3224116d8532dda8dae
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.9MB
                                                                          • SHA256 990938f4fefabf1813600050232b2492b1ae1d7999fe9486e06647b4d39fb4e9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.9MB
                                                                          • SHA256 120e6b416bd3fd3240974a493371266bdd5b49f7d35059c3b89ab746d7d021f9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.8MB
                                                                          • SHA256 7fc418a6a695ad3d13d3d76860d750a4e81716fe76ef976b94b887c6c542fdfa
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.8MB
                                                                          • SHA256 03a5d9ef975cffbcd6bdde7c898950c00a62142c009abf4a640c1143ddbe7aa9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.7MB
                                                                          • SHA256 b0104615170e59921040da51634d2d5520b6018eb2b370f11476308ef1c9f4af
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.9MB
                                                                          • SHA256 27b04455a9117c944b68922bc21f399d2fdf95374686b58975c16e307bb3bd88
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.8MB
                                                                          • SHA256 c535287e825dff704574788d6cadef8423d6470d4592ae9a0d616d345ed0f5c7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.6MB
                                                                          • SHA256 58cf2d8c278651f9bcba4e114fe08bab64c172ce69871e8baeaec9d1f3f986db
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.7MB
                                                                          • SHA256 480eea22f2a150c131954ce0f176969328a4be31f348a356895078b1fb11dabb
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.5MB
                                                                          • SHA256 774654efa3d8bae5e5e810bf5ea63da597a63d23259e91047e4bec2620a1d939
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\5514b1d9150be3d62770e9284a88299b9c80c901945e151419fd42db17ca75dd.exe.exe
                                                                          • Size 3.6MB
                                                                          • SHA256 da9eace4b5674f16d4d1c5533fcd4450278d7285205c4c482ff691a7262af9cd
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Logo1_.exe
                                                                          • Path C:\Windows\Logo1_.exe
                                                                          • Size 32KB
                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          _desktop.ini
                                                                          • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                          • Size 10B
                                                                          • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          memory/200-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/292-8206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/800-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/860-8200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/960-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1032-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1096-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1116-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1140-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1220-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1220-2853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1220-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1220-117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1492-8543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1532-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1536-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1544-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1552-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1560-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1764-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1820-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1824-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1860-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/1952-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2024-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2052-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2148-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2204-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2208-103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2232-8356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2288-6112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2304-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2312-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2324-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2408-6134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2524-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2640-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2652-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2764-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/2852-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3020-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3024-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3052-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3196-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3256-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3320-1903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3452-6141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3548-8170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3564-1894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3672-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3824-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/3860-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4068-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4112-5633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4124-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4128-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4180-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4196-8176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4220-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4252-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4332-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4356-8320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4436-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4436-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4468-1585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4472-8125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4484-5348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4496-8567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4504-8416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4524-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4524-8694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4544-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4588-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4600-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4636-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4648-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4664-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4716-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4740-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4772-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4876-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4900-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4908-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4924-6103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/4988-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5004-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5024-6121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5192-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5212-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5224-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5236-8302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5360-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5368-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5412-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5416-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5432-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5528-112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5572-6147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5608-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5616-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5640-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5664-45-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5688-8120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5688-5623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5732-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5800-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5836-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5844-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5860-8146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5872-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5932-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5952-122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/5960-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6036-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6048-8452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6052-8131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6116-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download

                                                                          memory/6128-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                          Download