5074bdbe52a2989633819f978e9de606274e953a32b4837bb7f36be18dfa3bba

Analysis

max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox.bat
Size 33B
Sample260828-b2akssem2w
SHA256 5074bdbe52a2989633819f978e9de606274e953a32b4837bb7f36be18dfa3bba
MD5 e19b5ecf437edd8f237ed803bd766171
SHA1 b52310e409fcb541222f3c3d3cf5eb05c57b22bd
SHA512 8eca3ba2f410993ea112e5a4c109d48d0d4971cbd70fecec06a92b336ed8477b32e73c3a0ee8f55db7de4a270584d8144011375372a5083e95e768eaeaef7a56
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1252	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4260	1252	cmd.exe	86
PID 1252 wrote to memory of 3396	1252	cmd.exe	88
PID 1252 wrote to memory of 4420	1252	cmd.exe	89
PID 1252 wrote to memory of 3100	1252	cmd.exe	90
PID 1252 wrote to memory of 3252	1252	cmd.exe	91
PID 1252 wrote to memory of 3616	1252	cmd.exe	93
PID 1252 wrote to memory of 3128	1252	cmd.exe	94
PID 1252 wrote to memory of 3316	1252	cmd.exe	95
PID 1252 wrote to memory of 5016	1252	cmd.exe	99
PID 1252 wrote to memory of 3504	1252	cmd.exe	103
PID 1252 wrote to memory of 1992	1252	cmd.exe	104
PID 1252 wrote to memory of 4200	1252	cmd.exe	105
PID 1252 wrote to memory of 624	1252	cmd.exe	107
PID 1252 wrote to memory of 4328	1252	cmd.exe	108
PID 1252 wrote to memory of 1780	1252	cmd.exe	109
PID 1252 wrote to memory of 3032	1252	cmd.exe	110
PID 1252 wrote to memory of 1792	1252	cmd.exe	111
PID 1252 wrote to memory of 1112	1252	cmd.exe	112
PID 1252 wrote to memory of 4660	1252	cmd.exe	114
PID 1252 wrote to memory of 4816	1252	cmd.exe	115
PID 1252 wrote to memory of 2024	1252	cmd.exe	116
PID 1252 wrote to memory of 3780	1252	cmd.exe	118
PID 1252 wrote to memory of 4964	1252	cmd.exe	122
PID 1252 wrote to memory of 3804	1252	cmd.exe	126
PID 1252 wrote to memory of 3472	1252	cmd.exe	128
PID 1252 wrote to memory of 1304	1252	cmd.exe	133
PID 1252 wrote to memory of 2312	1252	cmd.exe	134
PID 1252 wrote to memory of 1432	1252	cmd.exe	136
PID 1252 wrote to memory of 1144	1252	cmd.exe	138
PID 1252 wrote to memory of 4940	1252	cmd.exe	140
PID 1252 wrote to memory of 2628	1252	cmd.exe	141
PID 1252 wrote to memory of 4936	1252	cmd.exe	143
PID 1252 wrote to memory of 3960	1252	cmd.exe	144
PID 1252 wrote to memory of 3004	1252	cmd.exe	146
PID 1252 wrote to memory of 1748	1252	cmd.exe	148
PID 1252 wrote to memory of 3360	1252	cmd.exe	150
PID 1252 wrote to memory of 2656	1252	cmd.exe	152
PID 1252 wrote to memory of 4364	1252	cmd.exe	154
PID 1252 wrote to memory of 2976	1252	cmd.exe	156
PID 1252 wrote to memory of 4520	1252	cmd.exe	158
PID 1252 wrote to memory of 1596	1252	cmd.exe	161
PID 1252 wrote to memory of 468	1252	cmd.exe	163
PID 1252 wrote to memory of 4916	1252	cmd.exe	165
PID 1252 wrote to memory of 1084	1252	cmd.exe	166
PID 1252 wrote to memory of 4824	1252	cmd.exe	167
PID 1252 wrote to memory of 540	1252	cmd.exe	170
PID 1252 wrote to memory of 760	1252	cmd.exe	172
PID 1252 wrote to memory of 2236	1252	cmd.exe	173
PID 1252 wrote to memory of 4024	1252	cmd.exe	174
PID 1252 wrote to memory of 4424	1252	cmd.exe	175
PID 1252 wrote to memory of 4832	1252	cmd.exe	176
PID 1252 wrote to memory of 2368	1252	cmd.exe	177
PID 1252 wrote to memory of 3208	1252	cmd.exe	178
PID 1252 wrote to memory of 4384	1252	cmd.exe	179
PID 1252 wrote to memory of 3092	1252	cmd.exe	180
PID 1252 wrote to memory of 2192	1252	cmd.exe	181
PID 1252 wrote to memory of 2480	1252	cmd.exe	183
PID 1252 wrote to memory of 4908	1252	cmd.exe	188
PID 1252 wrote to memory of 1916	1252	cmd.exe	191
PID 1252 wrote to memory of 4716	1252	cmd.exe	193
PID 1252 wrote to memory of 1260	1252	cmd.exe	196
PID 1252 wrote to memory of 3784	1252	cmd.exe	200
PID 1252 wrote to memory of 1796	1252	cmd.exe	202
PID 1252 wrote to memory of 5084	1252	cmd.exe	205

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Roblox.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3396
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3100
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3616
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3316
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1992
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4200
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:624
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1112
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4660
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3472
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1432
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3004
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4364
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4520
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1084
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:760
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4024
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4424
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3092
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2480
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1260
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5084
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4476
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2624
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:804
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4120
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:644
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4180
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5700
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6348
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6372
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6388
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6400
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6440
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6468
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6504
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6560
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6584
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6612
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6644
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6672
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6744
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6844
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6908
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6976
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7000
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7028
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7048
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7056
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7104
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7128
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7688
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7788
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7920
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7936
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7948
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8040
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8108
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8136
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8144
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8152
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8160
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8176
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6636
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6492
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6664
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:7932
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8252
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8284
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8324
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8392
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8428
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8460
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8508
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8532
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8596
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8672
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8712
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8752
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8816
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8888
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8912
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:8956
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9288
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9296
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9304
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9556
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9900
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9928
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9952
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:9968
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10012
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10060
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10080
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10108
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10312
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10336
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10352
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10360
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10368
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10392
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10408
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10456
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10500
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10616
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10648
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10680
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10724
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10788
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10800
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10828
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10880
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11088
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:436
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10892
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:10628
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11380
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11520
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11536
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11544
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11576
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11584
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11592
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11600
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11608
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11616
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11624
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11632
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11640
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11652
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11708
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11748
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11780
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11820
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11924
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11960
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12216
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:12228
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11972
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11764
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:11660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/11600-1-0x00007FF720620000-0x00007FF720687000-memory.dmp

Download

memory/11708-0-0x00007FF720620000-0x00007FF720687000-memory.dmp

Download

memory/11764-2-0x00007FFBA2910000-0x00007FFBA2B05000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads