Overview

overview

7

Static

static

3

c4debb7b90...27.exe

windows10-2004-x64

7

c4debb7b90...27.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/04/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
  • Size 4.3MB
  • Sample260424-lt5fbaev2v
  • SHA256 c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3476
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF145.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3152
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF27E.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2080
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3C6.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4148
              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF52D.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2980
                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4484
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF685.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3336
                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2072
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7BE.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2228
                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:5836
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF925.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3756
                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5544
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA5E.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4828
                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4792
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBB5.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2392
                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:716
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCCF.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2032
                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:5764
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDF7.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:224
                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4540
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF5F.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5884
                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6104
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5892
                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4112
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A1.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:236
                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1804
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F9.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4448
                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2380
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a422.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5416
                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1496
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3248
                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:732
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A2.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4936
                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4052
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2436
                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5324
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A0.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5564
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1392
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB36.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3752
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4156
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1084
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1236
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2760
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:6132
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD78.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4332
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2236
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE05.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4644
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5736
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE91.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4432
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5940
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFF.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4516
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3340
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7C.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1500
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:6056
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF9.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1136
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:800
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1095.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1864
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1952
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1122.bat
                                                                                                                              62⤵
                                                                                                                                PID:2064
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2068
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11AE.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5500
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5844
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a124B.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:5408
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5772
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1299.bat
                                                                                                                                                68⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:856
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1700
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1345.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:4376
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:488
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13B2.bat
                                                                                                                                                          72⤵
                                                                                                                                                            PID:5196
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                              73⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:4176
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a144E.bat
                                                                                                                                                                74⤵
                                                                                                                                                                  PID:2240
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                    75⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4200
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14BC.bat
                                                                                                                                                                      76⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6108
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:5924
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1596.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:2564
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:5824
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16EE.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:5648
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:276
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17E8.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:944
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:244
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B3.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:2320
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5348
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1940.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19DC.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A69.bat
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF5.bat
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B72.bat
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                          PID:2116
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BEF.bat
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C6C.bat
                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                      PID:2252
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:792
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CF9.bat
                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D95.bat
                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:3872
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E60.bat
                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F2B.bat
                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F89.bat
                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                    PID:3132
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FF7.bat
                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:3712
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2074.bat
                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20F1.bat
                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a219C.bat
                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a220A.bat
                                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2277.bat
                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                  PID:3028
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2304.bat
                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23A0.bat
                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243C.bat
                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24D9.bat
                                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:3960
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2556.bat
                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:4236
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25B3.bat
                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2528
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2621.bat
                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                          PID:3972
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a268E.bat
                                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26EC.bat
                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:5516
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2778.bat
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27E6.bat
                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4140
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2882.bat
                                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5300
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291E.bat
                                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a298C.bat
                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:492
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:324
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E9.bat
                                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A47.bat
                                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:840
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AB5.bat
                                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B32.bat
                                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3062.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a310E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a316B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3236.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3350.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3582.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a367C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3747.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3832.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a388F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a390C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a397A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DCF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4040.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4188.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4225.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:4336
                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:5280
                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:4952
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1000
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          PID:5216
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4336 -ip 4336
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:228

                                                                                                                                                                                      Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            $$a1A1.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1A1.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 bc8c1345253767b87886f1eccde3c30f3b5a43acc72eeb7e03560141d2a53636
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a2F9.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2F9.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 259a757ebd7b36ad63007acdffbe8de1092e3ec07347bcd9eb4f67a524fecbe0
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a422.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a422.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 99e3383b163c82ccae2cb17c946a6b128e393384b7055c10e679b178ea0a7592
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a56A.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a56A.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 c9099c0ccbfc8eb4840cb60e42b43aa884c483674a00fa0a16f1f0e6b09e68d2
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a68.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a68.bat
                                                                                                                                                                                            • Size 720B
                                                                                                                                                                                            • SHA256 22a4bebe7812ffba8fababd9ec7ff849dc76163d75a03d11bda445c1d9795443
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a6A2.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6A2.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 748234dc8baa04ad0678238b14609150716255a2dbab88545526cd50799522d6
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a819.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a819.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 de66276ea5db6110e4a087b25e4ebed015e04c20b9a8e8f849639239de21d28d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$a9A0.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9A0.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 6e0621ffb04dbc7edbf7bd2e2285001cfff8a3523ebb95e0ec60167f84d5e79a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aB36.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB36.bat
                                                                                                                                                                                            • Size 721B
                                                                                                                                                                                            • SHA256 02ed893e30c152d311158d47cbbba3f03f3f7040ab981510945b47964db3ba22
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF145.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF145.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 4793c2c9d784f3b13754c82d3f2a4de6cd62ac83caf72004cc1a1a4e32083b1a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF27E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF27E.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 de0de73b2de435f7fc85936bdd77674b5e1cd6e4e6019946e1281b36a885e49f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF3C6.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF3C6.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 ee724aec821e9f55da4947aa35bf7cb2de5ba6be06e5b54d7060c96014fa560f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF52D.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF52D.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 89827a164e53a0747fc2ed67557669bc163f1c672b0b45b7ce3ab5a58f3594cc
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF685.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF685.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 9ad079a161dc4d742cc90fb2d1deb0976b10b671430920027036bf57ef327bc3
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF7BE.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF7BE.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 eb2819cced09e3376a1bd0f2ba9afe7a7631dbee8ee29bb11bbb453b2d1c579b
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aF925.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aF925.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 c85920be7992bb0d48e44b98c720ad82ca3da894be8c272d862c5f2b4606ce1f
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aFA5E.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFA5E.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 42c6b09f37480d293da486d096df9c7233f630dad35a2070266f5ea8576ade05
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aFBB5.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFBB5.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 f35f2612b46716a8df781c5223cf199e7f328d05efb05d7e776963b925d8ab9d
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aFCCF.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFCCF.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 073e069a7ca05da256666892bf8898d5181e04b78c7710d8d12a567577cd3b8a
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aFDF7.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFDF7.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 49a3a756728cd46345b8377de7773177a972f93d72b3b18633b86ca9ebbb575e
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            $$aFF5F.bat
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aFF5F.bat
                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                            • SHA256 0321058067668c31011c45bc58d95e1eb8dd2bf4074438ca579fc509095d3586
                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 304fc02aefe3c1855bd1f12cc67909c5750356bde0d022368eb166823aa7d445
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 3099c7a28a64c93995d6371e0953f07c2ec61164cb6fb55dd36a003c28d19294
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.3MB
                                                                                                                                                                                            • SHA256 dee69755823401ceefb8dd3dfb9b2abd0c42a5fd54c4cad00e4d367482e05e3b
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 67f6c490b732e61903675934a87bc229a75d2e6629b7973d555859bc96ad31ef
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 1b246a41756e39229a66da1043a7c07bc23c3d97def4e59eab0b1d6b706f8707
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 35fbfd53cecf126e1f97ff0bf1478ec852ba88da0896c6166b4f195494d4132f
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.2MB
                                                                                                                                                                                            • SHA256 57b813b03d2d89442dc18dc79002e86f48cfab6f4eea297953320ced2f22340d
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 cb21a2432ecb97eb489d5c965796aeccb30e172613caa772e547201d594d59de
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.7MB
                                                                                                                                                                                            • SHA256 51449e50c7ad3f539e60dd9cf976e8b03e396760a2e5afbfb71e1f4c4845324e
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 fd9faad9a5c65525433f2267e1f0557a8b6112f0ec24b79e4d17bd1996155b03
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.1MB
                                                                                                                                                                                            • SHA256 f411f0c639e77a281f34a6da7fbd5cb63ea14c6ce0800962520d844ccbacdafc
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 6f7cc8833d07ff8340d975348f5e35aff8c98a77b9b1d0bbd9648befbf4b6b63
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 d1a92e25768f86cdb816886e4e38a1983d544e941171059364ae2ca4269cdaf4
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 4.0MB
                                                                                                                                                                                            • SHA256 d32af5caab996ad59f5d4bc93127fa509463fd8fdcf218e9fda83b86c46dda20
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 118d438352a356fff058cb09a9bd591e76b4f885204ef29334a4944ca30353bf
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 ed77f287d86f30558afdd546abc55a52f403ff9698bab5aa94058caf229582e4
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.9MB
                                                                                                                                                                                            • SHA256 3f72f42b7c1a52430c5073aaba19d19491b257ceb5b8e03cdc96880451ac67bf
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 0c408b832c7edb9ccd65094e5b433990113a268da5f68004ca19f1ce4550bac0
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 ac6ea4b5170b1fa6e81af2ee7af517367e3f8b69a126e12cad7b6bc3fd9d78db
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c4debb7b906228ba75cfda4b12610197213cab289bd02a423205ad9c78019d27.exe.exe
                                                                                                                                                                                            • Size 3.8MB
                                                                                                                                                                                            • SHA256 b2f6b8e3a7a0083aa3a63cec8fa64dfcb62b06d1e34f47bb8af55378e30e5e13
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-2397528088-2630719772-1129911217-1000\_desktop.ini
                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                            • SHA256 cf938a4f3b0b887724302ddf4689d13c4979f5470df615074767908c6ef30aa0
                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                            Submit Download

                                                                                                                                                                                            memory/244-406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/276-402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/324-550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/488-376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/560-705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/600-570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/620-476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/716-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/732-174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/792-439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/800-352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/840-560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1140-535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1208-635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1236-324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1304-484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1392-315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1420-690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1496-141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1572-782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1572-787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1636-472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1664-655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1700-372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1804-127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/1952-356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2068-360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2072-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2080-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2128-620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2136-456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2152-725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2180-422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2188-590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2236-332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2304-575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2380-134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2384-600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2456-710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2520-675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2528-510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2552-630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2628-525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2792-418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2796-468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2812-680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/2944-435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3048-434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3096-665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3108-580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3152-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3232-700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3236-515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3264-756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3328-771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3340-344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3372-565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3392-414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3420-645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3476-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3476-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3560-545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3576-695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3640-452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3712-464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3724-640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3872-448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3876-585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3904-730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3960-500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/3968-766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4052-294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4112-118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4144-740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4156-320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4172-745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4176-380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4188-720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4200-384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4212-685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4232-610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4236-505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4336-389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4336-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4336-89-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4368-660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4484-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4540-104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4552-605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4580-426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4640-480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4708-761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4744-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4760-492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4792-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4804-555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/4944-430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5008-488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5028-735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5056-460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5180-615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5296-530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5324-308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5332-496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5348-410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5384-540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5436-650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5532-595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5544-71-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5580-751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5628-776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5684-444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5736-336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5764-97-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5772-368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5788-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5824-397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5836-58-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5844-364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5848-715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5900-520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5916-625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5924-390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/5940-340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6056-348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6096-670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6104-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download

                                                                                                                                                                                            memory/6132-328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                            Download