Overview

overview

7

Static

static

3

c4debb7b90...27.exe

windows10-2004-x64

7

c4debb7b90...27.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/04/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
  • Size 4.3MB
  • Sample260424-lt5fbaev2v
  • SHA256 c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5501.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5697.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2712
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B1B.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2324
              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4248
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE6.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1328
                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:564
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E96.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5112
                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:3132
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F22.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1188
                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4620
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a608A.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1996
                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2468
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6230.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1136
                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3340
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6453.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1932
                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1824
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6637.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4156
                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4376
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a681B.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3296
                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:924
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A1F.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2720
                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4984
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CA0.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4320
                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1660
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E94.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:540
                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1180
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71A1.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2744
                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1232
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7366.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1256
                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2444
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B8.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1288
                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3568
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7952.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4356
                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2548
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A7A.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4504
                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1452
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BE2.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3784
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2084
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE5.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:980
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:456
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E53.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4252
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3684
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EDF.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4192
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3916
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F9B.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4648
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4516
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8037.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2328
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4880
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80F3.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3724
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4856
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819F.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3084
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4208
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a824A.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:624
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1812
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F6.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:632
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2356
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8383.bat
                                                                                                                          60⤵
                                                                                                                            PID:1564
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1884
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842F.bat
                                                                                                                                62⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:936
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:640
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8538.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:1752
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:2032
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85E4.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:312
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1880
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8681.bat
                                                                                                                                                68⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4488
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4896
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86EE.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:3272
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:1200
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a875B.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:4188
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2700
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8817.bat
                                                                                                                                                                74⤵
                                                                                                                                                                  PID:872
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:904
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8884.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1008
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4400
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8911.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:4492
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:228
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a897E.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2024
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4312
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89EC.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4740
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:2796
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A97.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:1296
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:536
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B24.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BA1.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1860
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0E.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:3832
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2728
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CAB.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3924
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D18.bat
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                        PID:2128
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DC4.bat
                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4112
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E22.bat
                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3384
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9F.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3348
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F0C.bat
                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F89.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE7.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9073.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                        PID:3476
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:2872
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90D1.bat
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:1440
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a915E.bat
                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2224
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91AC.bat
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1268
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9229.bat
                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:2748
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9277.bat
                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9313.bat
                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:1808
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9371.bat
                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2716
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:3648
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CF.bat
                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a943C.bat
                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                            PID:3764
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a949A.bat
                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                    PID:3592
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9507.bat
                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                        PID:3956
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9594.bat
                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                              PID:3288
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95F2.bat
                                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966F.bat
                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                              PID:752
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96FB.bat
                                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9769.bat
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3012
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:3676
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D6.bat
                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9843.bat
                                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98C0.bat
                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a990F.bat
                                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a998C.bat
                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A09.bat
                                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A66.bat
                                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B51.bat
                                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA004.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA081.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA12D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA217.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA284.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA36F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA44A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA534.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA718.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA786.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA822.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA989.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD42.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:3716
                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:4468
                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1220
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 772
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:2448
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3716 -ip 3716
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5028

                                                                                                                                                                                          Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                $$a5501.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5501.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 795f9f1f0c725c2cb99ea0ce7cfc80f757a21954dfcce07cee25b65ed4ad5b3f
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a5697.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5697.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 1ba8f63bb83c9a1266eca4039517fbafbcca54b8a268ece46580f4b7975c8165
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a5B1B.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5B1B.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 931e687ccd1c9c4e4202599c45ae8dc5d8027f56f1dd39ff04e6a97242fc795e
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a5BE6.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5BE6.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 6f0c9abc3fcffd25785cc18668c6bd93251af45857b369ad8ae940270b89fdfc
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a5E96.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5E96.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 a60761cdb68b5895eb63b951826ea0ae7d9f6da06d6aa08aa5065586f2ccfc05
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a5F22.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5F22.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 a40cbd884d8687741b5a4ebb7a8acd10b7a419eb86376e161bb14cd8ef6b2bf2
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a608A.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a608A.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 77e315bcbf0c31de4fb529fb7ff6cff00d3503761cfd2a311e6286ef78e98ceb
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6230.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6230.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 48c91a18ce859e7ae8af56adf7dda19de352a4a7e3c87116101df11011703851
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6453.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6453.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 5df74a016856aff750009b213f2823d7348872ea847f7f78f47fd26188ea8fb8
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6637.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6637.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 917a22b9899f9f1a286612ebe70170e56df06fb288809e850a092053df8e1a6f
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a681B.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a681B.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 59a3ee886974869a74b077e06793bab8d2fe29670db554f31c10f050b2659b3a
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6A1F.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6A1F.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 d7e5ed19abec111039fb68bd3730547f6d3743340bdaa952c75eb45f8cac3593
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6CA0.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6CA0.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 cfeb747f7e4a5a795d342af26df89d37dc25704d08b8f4e0beee494013a70d19
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6E94.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6E94.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 fdacd4c948b22f587dc8705f27b257c1d616e6bfa09a5c50da35312a9e7d72d6
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a71A1.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a71A1.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 516b6b74b057abde22cfe8814e5a63d45bb9b219c476486eca6ae51b156a6a5c
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a7366.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7366.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 23af84110af8135975e9aa4cb4de9a669db450080db3dd20933a320b666ca6a9
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a75B8.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a75B8.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 a2967a01dd2601d0e418331342b6a7b9f45333a4bf46f8b1ceca4959b8d36dfb
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a7952.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7952.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 ca34835d4b885eb0a8a02d08a7e5d7edf79d4609fcc0126da94a3eda3391e6bb
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a7A7A.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7A7A.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 55b8399efa07dfdff6a04599558bd8c863bed19353208c53133e0bc67fb6c809
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                                • SHA256 1b246a41756e39229a66da1043a7c07bc23c3d97def4e59eab0b1d6b706f8707
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                                                • SHA256 dee69755823401ceefb8dd3dfb9b2abd0c42a5fd54c4cad00e4d367482e05e3b
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.9MB
                                                                                                                                                                                                • SHA256 118d438352a356fff058cb09a9bd591e76b4f885204ef29334a4944ca30353bf
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.9MB
                                                                                                                                                                                                • SHA256 ed77f287d86f30558afdd546abc55a52f403ff9698bab5aa94058caf229582e4
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.9MB
                                                                                                                                                                                                • SHA256 3f72f42b7c1a52430c5073aaba19d19491b257ceb5b8e03cdc96880451ac67bf
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.8MB
                                                                                                                                                                                                • SHA256 ac6ea4b5170b1fa6e81af2ee7af517367e3f8b69a126e12cad7b6bc3fd9d78db
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                                • SHA256 57b813b03d2d89442dc18dc79002e86f48cfab6f4eea297953320ced2f22340d
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.0MB
                                                                                                                                                                                                • SHA256 d1a92e25768f86cdb816886e4e38a1983d544e941171059364ae2ca4269cdaf4
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.8MB
                                                                                                                                                                                                • SHA256 0c408b832c7edb9ccd65094e5b433990113a268da5f68004ca19f1ce4550bac0
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                                • SHA256 67f6c490b732e61903675934a87bc229a75d2e6629b7973d555859bc96ad31ef
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                                                • SHA256 fd9faad9a5c65525433f2267e1f0557a8b6112f0ec24b79e4d17bd1996155b03
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.8MB
                                                                                                                                                                                                • SHA256 b2f6b8e3a7a0083aa3a63cec8fa64dfcb62b06d1e34f47bb8af55378e30e5e13
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                                • SHA256 35fbfd53cecf126e1f97ff0bf1478ec852ba88da0896c6166b4f195494d4132f
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.0MB
                                                                                                                                                                                                • SHA256 6f7cc8833d07ff8340d975348f5e35aff8c98a77b9b1d0bbd9648befbf4b6b63
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.7MB
                                                                                                                                                                                                • SHA256 3099c7a28a64c93995d6371e0953f07c2ec61164cb6fb55dd36a003c28d19294
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                                                • SHA256 cb21a2432ecb97eb489d5c965796aeccb30e172613caa772e547201d594d59de
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.0MB
                                                                                                                                                                                                • SHA256 d32af5caab996ad59f5d4bc93127fa509463fd8fdcf218e9fda83b86c46dda20
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 3.7MB
                                                                                                                                                                                                • SHA256 304fc02aefe3c1855bd1f12cc67909c5750356bde0d022368eb166823aa7d445
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                                • Size 4.1MB
                                                                                                                                                                                                • SHA256 f411f0c639e77a281f34a6da7fbd5cb63ea14c6ce0800962520d844ccbacdafc
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2714754311-527593155-1440850301-1000\_desktop.ini
                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                • SHA256 cf938a4f3b0b887724302ddf4689d13c4979f5470df615074767908c6ef30aa0
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                memory/228-840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/456-739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/456-740-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/536-858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/564-55-0x0000000002060000-0x000000000211F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/564-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/640-792-0x0000000001F10000-0x0000000001FCF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/640-791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/752-1014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/884-1196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/904-828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/924-129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/924-130-0x0000000001FE0000-0x000000000209F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1036-1304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1052-1280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1072-1146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1076-912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1180-678-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1180-677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1200-816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1220-1140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1232-686-0x0000000001F00000-0x0000000001FBF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1232-685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1264-1002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1268-948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1372-960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1440-936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1452-729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1452-730-0x0000000001F60000-0x000000000201F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1512-978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1644-1268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1660-670-0x0000000002040000-0x00000000020FF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1660-669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1808-966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1812-777-0x0000000001F20000-0x0000000001FDF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1812-776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1824-100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1824-101-0x0000000001F40000-0x0000000001FFF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1860-870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1880-804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1884-786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1884-787-0x0000000002060000-0x000000000211F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1920-1178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1936-1172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1968-1110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2032-798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2068-1116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2084-734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2084-735-0x0000000002020000-0x00000000020DF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2160-22-0x0000000001F50000-0x000000000200F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2160-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2184-1008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2196-1310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2204-1214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2208-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2208-10-0x0000000001FC0000-0x000000000207F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2208-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2216-864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2224-942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2228-708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2228-767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2356-782-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2356-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2372-1160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2404-918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2440-1202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2444-694-0x0000000000550000-0x000000000060F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2444-693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2468-83-0x0000000001F70000-0x000000000202F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2468-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2540-1208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2548-721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2548-722-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2700-822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2712-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2712-32-0x00000000020C0000-0x000000000217F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2728-876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2748-954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2796-852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2836-1134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2872-930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2936-1250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2992-1056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3000-1154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3016-1128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3040-1062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3132-63-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3132-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3320-924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3340-91-0x0000000001FB0000-0x000000000206F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3340-90-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3348-906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3384-900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3404-1184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3516-1038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3568-710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3568-711-0x0000000002100000-0x00000000021BF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3592-990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3620-1232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3648-972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3676-1026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3684-745-0x0000000001FC0000-0x000000000207F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3684-744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3716-697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3716-105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3716-696-0x0000000001F80000-0x000000000203F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3716-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3748-1262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3776-1226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3876-1328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3880-1298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3916-749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3916-750-0x0000000002060000-0x000000000211F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3924-882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3952-1074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4000-1316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4056-1092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4100-1050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4128-1166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4196-1086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4208-772-0x0000000001F90000-0x000000000204F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4208-771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4216-1322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4236-1292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4248-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4248-41-0x0000000000660000-0x000000000071F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4260-1080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4300-1044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4312-846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4376-110-0x0000000001FF0000-0x00000000020AF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4376-109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4400-834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4436-984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4512-996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4516-756-0x0000000002050000-0x000000000210F000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4516-755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4540-1098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4564-1190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4620-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4620-71-0x00000000005F0000-0x00000000006AF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4640-1244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4680-888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4708-1286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4728-1256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4736-894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4764-1068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4844-1122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4856-765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4856-766-0x0000000001FF0000-0x00000000020AF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4880-761-0x0000000001F20000-0x0000000001FDF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4880-760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4896-810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4976-1220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4984-649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4984-650-0x0000000001F30000-0x0000000001FEF000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5008-1274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5028-1104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5036-1020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5088-1032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5100-1238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download