Overview

overview

7

Static

static

3

c21c2f3e5c...3d.exe

windows10-2004-x64

7

c21c2f3e5c...3d.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/09/2026, 08:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
  • Size 3.5MB
  • Sample260922-kab4zssamd
  • SHA256 c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE6B.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4820
      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06F.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4392
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2C1.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2600
              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4984
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A5.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4560
                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4380
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82F.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2732
                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4432
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA71.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:688
                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1524
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB0E.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2908
                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:64
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD21.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4272
                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1528
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF05.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2840
                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3044
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC232.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4408
                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3824
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC426.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2880
                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1636
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC743.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1448
                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4544
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBC7.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2576
                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3088
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9F.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2000
                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2932
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1E1.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2964
                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4864
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FE.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3592
                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:224
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD750.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1964
                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:764
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0F.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:616
                                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2152
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC71.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:456
                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2296
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE087.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:984
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4784
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE153.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:596
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2268
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3C4.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4964
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4664
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE52B.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1120
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4184
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE625.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1400
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1776
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE75D.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4976
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4936
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7DA.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:812
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:920
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE877.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4844
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4244
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE971.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:972
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3184
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA1D.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4816
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3796
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB07.bat
                                                                                                                          60⤵
                                                                                                                            PID:3488
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1124
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBF1.bat
                                                                                                                                62⤵
                                                                                                                                  PID:1820
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4112
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC7E.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:1552
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4252
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB6.bat
                                                                                                                                            66⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2100
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5092
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE43.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:2708
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3752
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFAA.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4552
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1596
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0B4.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2264
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3228
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF160.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1740
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3688
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1DD.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2876
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1548
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF298.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:1756
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4092
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF315.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:3208
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2572
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF392.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:3032
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:5064
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF45E.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:976
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4428
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF567.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2716
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4928
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF623.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AF.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:904
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1752
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF74C.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7C9.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:4360
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF855.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:2076
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8E2.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:964
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF94F.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:2244
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA59.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:628
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB62.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:2584
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBEF.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:1328
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC9B.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:652
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD37.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE60.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF2B.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4540
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFB8.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:4016
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:832
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BB.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3844
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F4.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a381.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:2236
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C.bat
                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E8.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a565.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2528
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a640.bat
                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:2472
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71A.bat
                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C6.bat
                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a882.bat
                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4012
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                            PID:2712
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E.bat
                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3036
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA28.bat
                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD4.bat
                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:1744
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3652
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9F.bat
                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4400
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A.bat
                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD06.bat
                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:2420
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD1.bat
                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:2900
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D.bat
                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:4776
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF19.bat
                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:732
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1042.bat
                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:3484
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a113C.bat
                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3560
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11C9.bat
                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1340.bat
                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:204
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:780
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1572.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a165D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:840
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1728.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a196A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a205F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                      48⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:1716
                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        49⤵
                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                        PID:440
                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                          50⤵
                                                                                                                                                                            PID:4948
                                                                          • C:\Windows\Logo1_.exe
                                                                            C:\Windows\Logo1_.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Enumerates connected drives
                                                                            • Drops file in Program Files directory
                                                                            • Drops file in Windows directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4192
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              net stop "Kingsoft AntiVirus Service"
                                                                              3⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3248
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                4⤵
                                                                                  PID:2420
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 956
                                                                                3⤵
                                                                                • Program crash
                                                                                PID:4252
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 956
                                                                                3⤵
                                                                                • Program crash
                                                                                PID:3928
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
                                                                            1⤵
                                                                              PID:4956
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4192 -ip 4192
                                                                              1⤵
                                                                                PID:4580

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    $$aAE6B.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aAE6B.bat
                                                                                    • Size 722B
                                                                                    • SHA256 cbc8b388b70408419ff40f4aa1b3e631b5e7ac91f059e08b496fa03cd4ce6a7c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aB06F.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB06F.bat
                                                                                    • Size 722B
                                                                                    • SHA256 408349ab2eef2428aad018756601475b18b7e404b32078d39697b8e01b601349
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aB2C1.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB2C1.bat
                                                                                    • Size 722B
                                                                                    • SHA256 dec126dd5da2a848278675c2c5697af22b23bbf3147e353076483d859a6a6218
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aB4A5.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB4A5.bat
                                                                                    • Size 722B
                                                                                    • SHA256 f688e76e8f063fadcde3044d0d7dc9cf958443a9649a10bf22f56f8b7632efd6
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aB82F.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB82F.bat
                                                                                    • Size 722B
                                                                                    • SHA256 84f8555eb28ebe8dd9863a6d3d52f4d332e3c5917030d762c5d4c96981770b0f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aBA71.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBA71.bat
                                                                                    • Size 722B
                                                                                    • SHA256 b993ab16d1fbed9d4f37f21d63176e6a638c95b45e03c71bdf205632242e57f9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aBB0E.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBB0E.bat
                                                                                    • Size 722B
                                                                                    • SHA256 fafd28efbba5de6a034738898ad521085d75f2287301f9ca3c9a5fb01f231558
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aBD21.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBD21.bat
                                                                                    • Size 722B
                                                                                    • SHA256 85899d8f553061fc3fed1f21d0aad8c61151a5162d29958d9af27dac7652f049
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aBF05.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBF05.bat
                                                                                    • Size 722B
                                                                                    • SHA256 5eb10e4552f336ea6b56551090ae80a28f96255d7d71962254b6c0259b5815b3
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC232.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC232.bat
                                                                                    • Size 722B
                                                                                    • SHA256 bf5b6b9d9768aabc8d64c92cb49c767725a8d867d50f013e65489c91e51e0142
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC426.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC426.bat
                                                                                    • Size 722B
                                                                                    • SHA256 c77b07b37a81279fd384f6d69c9826deb41d795255cb3da23b042b7727c2ee5c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC743.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC743.bat
                                                                                    • Size 722B
                                                                                    • SHA256 d936dbaccf118c68acd643849ae149b3e9705a1029a6ba5a42e0d256c2e4a7fc
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aCBC7.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCBC7.bat
                                                                                    • Size 722B
                                                                                    • SHA256 1f7012bf205f1c54583351825c6a0ccc825de41d7b8038a1cb794aed6b81dc28
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aCF9F.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCF9F.bat
                                                                                    • Size 722B
                                                                                    • SHA256 bde0a313047c8c4c1bfafa32d73b5de25b737e0cd9b215e631ea02f76b401b23
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD1E1.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD1E1.bat
                                                                                    • Size 722B
                                                                                    • SHA256 497729444083eadf431c62f345fe923ac5f28bec3b76e45c9d0eb5e603f03440
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD4FE.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD4FE.bat
                                                                                    • Size 722B
                                                                                    • SHA256 6c60c687014928b1c57308ef9b93fe29ffcedac2f568d64fa993f788b5c0fcdd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD750.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD750.bat
                                                                                    • Size 722B
                                                                                    • SHA256 cd995d3b4b170801fa7053b6e33fd5db43c12867b122a6115b0c049bdfa89da4
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aDA0F.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDA0F.bat
                                                                                    • Size 722B
                                                                                    • SHA256 7d74cd23b99facd40bc7846690b565c77b1bc1e7a21f5704a1c046bc85385dc0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aDC71.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDC71.bat
                                                                                    • Size 722B
                                                                                    • SHA256 9f38295fa5e9046736200ce1c6939cc6ad71a05d458b3d1f783e41331b458c2b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aE087.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE087.bat
                                                                                    • Size 722B
                                                                                    • SHA256 e9051b69456fe410dac2b18de934d63ae858ed015fe2a0c5cce25d26dc89bc26
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aE153.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE153.bat
                                                                                    • Size 722B
                                                                                    • SHA256 6b12b1eb7ba7d806eacc84fe8956a64ebaf48dc236ecb3359ae0ec3b93048645
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.1MB
                                                                                    • SHA256 aa781db611f0f3172cd551b7a0c581bc62151d053e018801ecd34adde1d7be0c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.0MB
                                                                                    • SHA256 77360b5f8d2bedb685449bd4cf2ed3305395d0342deb8533b7cbecbaab9792c3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.0MB
                                                                                    • SHA256 9be1a2b40203d09a049440acea26777f31f3370dae021ade16463d8284314ee5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.0MB
                                                                                    • SHA256 9ef665802eb379c0be4783656aaa10e7ba22412b4522187c7db9027d4557cb90
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 2.9MB
                                                                                    • SHA256 b704bbbcdb09795354170084c4998fa5cdfb89bc87ac91f3638d17e8bf443cb3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 2.9MB
                                                                                    • SHA256 c899d0ecf93b77f4b2e064d834458013d32560e2345b587e6f86d16afca268b5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 9fb990152ad334c089f7155d7e63e09a2d6c0194bad9cd4453b26231821508f3
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 94f95bb6de4862f84ce5c75f81c1741e9600dc65a4ff66e90108ec031c16da24
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 2.9MB
                                                                                    • SHA256 5f056cc486894a0ad930770ad7d3deb42bc337e97c3cc79502407cd33ef219cc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 2.8MB
                                                                                    • SHA256 8939024a5dbb7bd9045b19548b1e9844a1f3babc6be8de7adb42507c413910a1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 f6b6a54ecf80da1394d6fad7b18409d53c6d97f6f3d4ba97d61bbe51c68d1dcc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 e79ad4206e129838faa6b7b36ac116bc0558a9b5720d779ebd898b9923ef2185
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 d19f90aa8b6ea016a837fb93f1312ef74df6b5602300e4716e0b67acf876db42
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 62f404033723b3008ccb3b52b24f7ecd6a63edf2970862a4d441dc1b63ebed51
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.2MB
                                                                                    • SHA256 bb677596a6530bd359c8bfb8cadf84352a9009cfc3275d0d001ba123edb46f47
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.2MB
                                                                                    • SHA256 98554e6117cefa21d97b00924a8fd52f526597e94bf59dff14ce04cb79fdfd43
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.2MB
                                                                                    • SHA256 49c63cde7c00e8878fd645bf393bff5fdab6200300c245b3ef415d3641b142ba
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 2.8MB
                                                                                    • SHA256 f9c8db9fb0c0814f2a31a37ee0e12c92621bf15bbab0ea1ed2cbc4607f914504
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.1MB
                                                                                    • SHA256 456ba0d8bbde042c5ac07194ca6b5264556c0c5130f64b6c2dda1d9776143ce5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\c21c2f3e5cbaa1e836264d79866984efdcdac76ea1638e7a80a49157ef6ddb3d.exe.exe
                                                                                    • Size 3.1MB
                                                                                    • SHA256 ed07aed916c92c3e74a433a2c9dc356f8663ea6e651eb709bb987fac34a82c09
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    rundl132.exe
                                                                                    • Path C:\Windows\rundl132.exe
                                                                                    • Size 32KB
                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _desktop.ini
                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-1846164713-4096795028-774071693-1000\_desktop.ini
                                                                                    • Size 9B
                                                                                    • SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    memory/64-75-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/212-2485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/224-2062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/628-2497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/764-2233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/780-2671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/832-2537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/840-2686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/880-2711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/920-2395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/964-2489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1124-2411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1292-2469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1328-2505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1376-2666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1524-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1528-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1548-2445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1564-2736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1596-2433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1636-273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1716-2381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1716-2421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1752-2473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1776-2387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1996-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1996-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2064-2721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2152-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2236-2555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2268-2369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2276-2651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2296-2357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2312-2517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2324-2656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2396-2691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2464-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2472-2575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2520-2731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2528-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2572-2453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2584-2501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2712-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2724-2585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2780-2615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2792-2681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2852-2706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2900-2626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2916-2716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2932-1883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3036-2595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3044-91-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3088-1612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3092-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3160-2696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3184-2403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3228-2437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3308-2748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3400-2676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3456-2513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3480-2741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3484-2641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3560-2646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3652-2605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3688-2441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3752-2429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3768-2521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3796-2407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3824-99-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3844-2541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3924-2743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4032-2636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4092-2449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4112-2415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4184-2382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4192-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4192-95-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4192-2375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4192-2052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4244-2399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4252-2420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4380-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4392-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4400-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4428-2461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4432-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4468-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4484-2509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4496-2493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4540-2525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4544-1169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4576-2753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4636-2560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4664-2373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4692-2758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4704-2726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4708-2661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4760-2550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4764-2565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4776-2631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4784-2364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4856-2600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4864-1890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4916-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4928-2465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4936-2391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4944-2477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4984-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5012-2481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5052-2533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5064-2457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5072-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5092-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5112-2529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download