Overview

overview

7

Static

static

3

2cd3fdbd24...e6.exe

windows10-2004-x64

7

2cd3fdbd24...e6.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/09/2026, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
  • Size 4.2MB
  • Sample260919-qlcsjsfg73
  • SHA256 2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:464
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82E7.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84AC.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:408
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8836.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2540
              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B63.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4584
                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4564
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8F.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4768
                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9073.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1420
                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4100
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DE.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3032
                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2288
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9555.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3056
                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:1660
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98C0.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3308
                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4052
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C7A.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:452
                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4316
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FC5.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:1360
                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4616
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2B3.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4712
                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3048
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA68C.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2440
                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4452
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8DD.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4028
                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4692
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAD1.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3772
                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2084
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE3C.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4540
                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2148
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB021.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4024
                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5108
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B5.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1740
                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3400
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB735.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2136
                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2128
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC37.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3324
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3916
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCA4.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4328
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3984
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEC7.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4404
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5072
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF44.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3176
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3224
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFB1.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2244
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1268
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC04D.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:808
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4784
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC109.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4304
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2108
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC203.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4632
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2596
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC290.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1612
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1960
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:216
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4148
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC35B.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:384
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1856
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C8.bat
                                                                                                                              62⤵
                                                                                                                                PID:4532
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3768
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC435.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:2988
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2212
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4A3.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:3016
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:4368
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC59D.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4324
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1908
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC704.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:3064
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4928
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC791.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4744
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1592
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC80E.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:1748
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4724
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC87B.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4348
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2300
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8F8.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:4704
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:2604
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9C3.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:4428
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4416
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA40.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:3348
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:1744
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCABD.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:828
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3808
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB3A.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2776
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2844
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB7.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:640
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1060
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC63.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:3908
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCE0.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:1132
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD4E.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:3204
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDCB.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:3672
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE28.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:3880
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE96.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:396
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF03.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:228
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF70.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:4676
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:3820
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFDE.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4728
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD04B.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B9.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3972
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD126.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1C2.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD230.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:2196
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD29D.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:2948
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:260
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD31A.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:2232
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD378.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:1580
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:3780
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3F5.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4A1.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD53D.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:3068
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D9.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:716
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD685.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:1564
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6F2.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:436
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:3424
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD76F.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:1984
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7CD.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                            PID:2428
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD84A.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D7.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                      PID:4520
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD944.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3368
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9F0.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3232
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA5D.bat
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3996
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAFA.bat
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB77.bat
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:1260
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC90.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1772
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD0D.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4032
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:1204
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3864
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE93.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1768
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF30.bat
                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE00A.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE124.bat
                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE24D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE395.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC5F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF056.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF121.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF23B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF46D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF72C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF884.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3944
                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                  PID:4520
                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2772
                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                            3⤵
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4644
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                              4⤵
                                                                                                                                PID:868

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              $$a82E7.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a82E7.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 4eb8b5d64188de533c70a97d95e8b43c7fc027f2c833472cf843b6121a4e452b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a84AC.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a84AC.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 316f7115665edcca9b6821b4e7a94695593c12909e46b439e6e0660b20ade73a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a8836.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8836.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 c5ba653f88f4cbceab6d2da2c2d920f2a8a5d0ab19ec8e447d13be7efa02118b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a8B63.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8B63.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 0c36ad33c465005588862f56f18fa5a736c8f7de13b8b6b368affd8d782628ab
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a8E8F.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8E8F.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 b3f4ae1df4cc23616632a5235266ae013fc9493d544cde796354574dc96025e8
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a9073.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9073.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 c544a91e61258f22f90f5588ce9b5b63e00e01918444a43590c4fc795518d4a5
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a93DE.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a93DE.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 3d6fd7091d1f99ecbb7bda90f31a5e5a071f78ce5ba47992a47bbdefcacd6cd4
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a9555.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9555.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 a4b9b698d798fb304b077a4ace9484ba436a04b6ab54723b26695aee4bcebae3
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a98C0.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a98C0.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 04e69a8ae7bad87f5d0206c9e7e656c8dea1fd0bc1f9c1a6dd06c9a5c10c1c30
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a9C7A.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9C7A.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 20a284b0eb3f6cecbe43a5386dee1006023fddbc1a5dce7864e59a7246fcee9b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$a9FC5.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a9FC5.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 a77b821392e34d0cdb57d45b6f2f3af1f2d6d9d7719fb5cdcb03512624eccfd3
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aA2B3.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA2B3.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 a0bf2eb732b34bb6accdc4b0d51416d56c4ab3d0da5f92bfa5deb1a3b6598d77
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aA68C.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA68C.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 a9243fc6be4be2fc209cf4e8b5077fc604f399c0cf3cbdd09f0fba8ae18e7703
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aA8DD.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aA8DD.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 6c9ad854d9b4a3d3656250ca180211e63b5c62a0bd200b17cbb9377eed488f05
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aAAD1.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aAAD1.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 c26382eac0a82bcb63ed4458afc286831f6811b6488d3d684162a70acb85979a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aAE3C.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aAE3C.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 3cebdfb2e1e298e06a6c159ceee1c55e4679515f20e71d22d68bec030d550b73
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aB021.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB021.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 5af1c0e984c521bfde73afe335a97b93be6c8fcde0f4d3d59b4949ae84f14d41
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aB4B5.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB4B5.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 5edeb70ed2b8bedfbb9309a5028bc0d712f5e4e3acae02ae2ffc9e824ee28453
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aB735.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aB735.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 161d72a349f632fa3f2ae9bbb78ed42be6fce6780c6f1e64788f84400baeb6c5
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aBC37.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBC37.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 1e814e0def27b133fdc6e56911ce7503758fb325cea8124e8348ff6842d41586
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              $$aBCA4.bat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aBCA4.bat
                                                                                                                              • Size 722B
                                                                                                                              • SHA256 0fe52c5be45cded9e0940472e3ea77381411f3b8c0394740c2a30031f57036f0
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.9MB
                                                                                                                              • SHA256 88226633f270d41533265051fcc8a5de17b051633c9efd553126033edaa1590c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.9MB
                                                                                                                              • SHA256 7943397e44db380f5f913c07a787f1872e807f8651e6e2c4016c9f68ecd8a640
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.8MB
                                                                                                                              • SHA256 1daf2953385c0e6519429e2078154ef028eabee9755f7b2cff7bda7516d8a5b7
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.8MB
                                                                                                                              • SHA256 babe3e8f65b36d70a0c36149dd89295686ca78bd2416c5342b893a5a135093ad
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.7MB
                                                                                                                              • SHA256 66b2a0832e4b2c2b8ed026087dc9b60d453c30e0c4740f29fbae361bf9931eb5
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.7MB
                                                                                                                              • SHA256 3a273b770a4b0edb8f2fa92f257d4dca9a233ea9efffd8eca4cdcc322b52ae49
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.1MB
                                                                                                                              • SHA256 65c5b78dd251476fd8f8370da2f23a023d4013484d6c78fbe8c5b29e3d692d34
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.8MB
                                                                                                                              • SHA256 6cb3ccddb258ba8d891c716f756a3e8cbf68f4209c8d78f85dc8d55d03dc3b7f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.7MB
                                                                                                                              • SHA256 0f7461df1d1c7ef585c5d9d606dbfc917074b0e18a6c1fe216e4b7a2e354af62
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.6MB
                                                                                                                              • SHA256 35d3aab9a4fb227521535f186cfd1a6bedf7c4759eae456b2108135c773d071c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.6MB
                                                                                                                              • SHA256 5a4d287430ccb90c58306dd7761d11bc6ccfe57f619c70774ae19d11c9f3c126
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.1MB
                                                                                                                              • SHA256 6d096d34ab350d685187e4665ec7a2d7ed538d83a93d63400f4d4b011c35c97f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.1MB
                                                                                                                              • SHA256 cd062addd005b88d69faf47af07ccb675b948ee3e69297892d40365fa7cf9b28
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.6MB
                                                                                                                              • SHA256 11060b612469d8cc8487b64a90bb4ff9f297c20679996dc1d1057256572ddeed
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.1MB
                                                                                                                              • SHA256 ee2a6c9311184613dc6e18b116d870672767baf288b82d1bb0b18c3daab59309
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.0MB
                                                                                                                              • SHA256 acf678d57eb8ca63941830ba3629821ef862682b0d7c5170e7c34492f8815bcc
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.0MB
                                                                                                                              • SHA256 11ec2e52fac5a705737509827f9b9fbce183cd5f984de290d4e8a9b8b0560a58
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.0MB
                                                                                                                              • SHA256 0d15ced580aed94683897f9993f99dad2026a3d1ba8aef87bcd8dbbcda763f4f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 3.9MB
                                                                                                                              • SHA256 2a8ea0942814426ec3eec649429834e183424997c521704b0e67b4ca0f6e09b2
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2cd3fdbd247f525ece66fb9f54963799df84e1b8491334448fd2a760c411d1e6.exe.exe
                                                                                                                              • Size 4.2MB
                                                                                                                              • SHA256 9cc64c9246793636473ab484158f9114183cd3d51f46ded8d0f0e3a90fc72a2d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Logo1_.exe
                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                              • Size 32KB
                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              _desktop.ini
                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-895009113-1202185046-1686627690-1000\_desktop.ini
                                                                                                                              • Size 9B
                                                                                                                              • SHA256 a07c6c223018094ee383f7c78086f3be8345e64d266ce54b79e9bff4b9ec69ec
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              memory/260-2688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/408-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/464-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/464-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/556-2814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/860-2648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/924-2902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/964-2942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1060-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1068-2809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1076-2892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1132-2636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1136-2744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1204-2779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1208-2977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1268-2539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1516-2917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1540-2784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1592-2594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1608-2912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1660-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1708-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1744-2614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1772-2774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1800-2804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1856-2563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1900-2972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1908-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1944-2854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1960-2555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1996-2962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2064-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2084-2127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2108-2547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2120-2579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2120-2619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2128-2515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2148-2305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2208-2644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2212-2571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2216-2967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2236-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2288-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2300-2602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2364-2668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2596-2551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2604-2606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2616-2844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2636-2922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2684-2819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2760-2907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2772-2573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2772-1880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2772-1055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2772-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2844-2623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3048-1855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3068-2709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3204-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3224-2535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3232-2754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3248-2861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3292-2859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3356-2897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3368-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3400-2506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3424-2724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3448-2684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3472-2932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3500-2829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3544-2993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3544-2988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3704-2839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3744-2799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3748-2952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3768-2567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3780-2696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3800-2656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3808-2618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3820-2660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3908-2632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3916-2522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3920-2764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3972-2672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3976-2769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3984-2527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3992-2927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3996-2759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4052-195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4100-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4148-2559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4184-2789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4260-2849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4316-1059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4352-2987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4368-2581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4372-2824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4392-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4416-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4420-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4452-1876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4460-2947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4484-2700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4500-2866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4544-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4564-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4568-2982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4580-2876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4596-2704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4616-1150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4620-2652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4628-2714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4648-2794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4668-2881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4688-2734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4692-1884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4724-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4728-2664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4784-2543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4864-2692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4884-2676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4920-2937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4928-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4936-2680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4988-2957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5012-2834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5028-2871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5072-2531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5080-2739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5108-2391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                              Download