Overview

overview

7

Static

static

3

9af26bf291...50.exe

windows10-2004-x64

7

9af26bf291...50.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 09:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
  • Size 3.9MB
  • Sample260924-lfxtbaae42
  • SHA256 9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDAE.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFF0.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4100
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3860
              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:220
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC60A.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1696
                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1352
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC908.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4028
                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3116
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE6.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:452
                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5012
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEA5.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3776
                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2548
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F7.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:640
                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4748
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD378.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3040
                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:552
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD702.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3076
                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4372
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB09.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3968
                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4772
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF01.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1704
                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:212
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DF.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1964
                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4368
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE450.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4040
                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4948
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB36.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4608
                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:908
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF7C.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3560
                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2808
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF25A.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2540
                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1048
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF49C.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3328
                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:468
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF76B.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4448
                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3824
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB43.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3516
                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1444
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4316
                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:744
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC7C.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4952
                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1068
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCF9.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4624
                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4516
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD76.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2788
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4788
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDD3.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1264
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1368
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFECD.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4888
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:684
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF79.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:8
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4132
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2064
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5084
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4068
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4104
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BB.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3392
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1052
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1392
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5020
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E4.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4128
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2436
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:1920
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4892
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B9.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3320
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:3112
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a555.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:2140
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3868
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a601.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1404
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:1868
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67E.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:2752
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:416
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EC.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:1844
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4472
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a759.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4912
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4508
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C6.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4872
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1384
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a853.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:696
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:4980
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FF.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4176
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4828
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                      PID:4640
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:988
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA08.bat
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:876
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:4808
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA95.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:1072
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB12.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:920
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFC.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD16.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:1648
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE00.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7D.bat
                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA.bat
                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB6.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:208
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1013.bat
                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1071.bat
                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:1176
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BF.bat
                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a115B.bat
                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1255.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a138E.bat
                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3216
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1478.bat
                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                PID:3544
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2116
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1534.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:3648
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1582.bat
                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:3708
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15E0.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:3008
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a163D.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                    PID:2088
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a168C.bat
                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1984
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:664
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16F9.bat
                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3844
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1747.bat
                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:3440
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A5.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4632
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                          PID:3152
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1860.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a190C.bat
                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3920
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19B8.bat
                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A64.bat
                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:3084
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AF1.bat
                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:2000
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BCB.bat
                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CE5.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDF.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3608
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F07.bat
                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:4172
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FB3.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a207E.bat
                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2984
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E6.bat
                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2282.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a235D.bat
                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:880
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2438.bat
                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:812
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2532.bat
                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a259F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a264B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2764.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2987.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a303E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3816
                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                      32⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Enumerates connected drives
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:4184
                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                        33⤵
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:3024
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                          34⤵
                                                                                                                                            PID:2652
                                                                          • C:\Windows\Logo1_.exe
                                                                            C:\Windows\Logo1_.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Enumerates connected drives
                                                                            • Drops file in Program Files directory
                                                                            • Drops file in Windows directory
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3344
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              net stop "Kingsoft AntiVirus Service"
                                                                              3⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4260
                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                4⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:636
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
                                                                              3⤵
                                                                              • Program crash
                                                                              PID:1268
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
                                                                              3⤵
                                                                              • Program crash
                                                                              PID:3320
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3344 -ip 3344
                                                                          1⤵
                                                                            PID:3392
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3344 -ip 3344
                                                                            1⤵
                                                                              PID:620
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3344 -ip 3344
                                                                              1⤵
                                                                                PID:2736

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    $$aBDAE.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBDAE.bat
                                                                                    • Size 722B
                                                                                    • SHA256 9d39a1c46a8e307114cedd9efd23b795c3ba5a9a00fc879ea354665d227bfe7b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aBFF0.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBFF0.bat
                                                                                    • Size 722B
                                                                                    • SHA256 2321771af2827b58b38bccd014fbff632c36726d20c538899c137beb3987fad9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC2ED.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat
                                                                                    • Size 722B
                                                                                    • SHA256 e07484f9d93dc21e8fa06b90f58c976a6ea87d839fecfa271a844af288a146e3
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC60A.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC60A.bat
                                                                                    • Size 722B
                                                                                    • SHA256 7ebd7a4b0054a6bfafac6f6fe344fcaeae88030a9d65a07e3000b8e587cf757b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aC908.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC908.bat
                                                                                    • Size 722B
                                                                                    • SHA256 0f85abd3b4489a83f420bc7e454f8d626806d7a9bb11ff1d8e152579f9e9e6b0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aCBE6.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCBE6.bat
                                                                                    • Size 722B
                                                                                    • SHA256 19fce5dacd9cb3287118225037eecad7404d00e45a715f19f4aa925bfee2432c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aCEA5.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCEA5.bat
                                                                                    • Size 722B
                                                                                    • SHA256 042c5760cfc6d6675f807c4c88f070fbbec9c476c3b40afa0cd1842b5c5a5e23
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD0F7.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD0F7.bat
                                                                                    • Size 722B
                                                                                    • SHA256 4412982c5384c0e5e643fa303f292e97cb7b6c7ca94fb60a329bac37cabad66e
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD378.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD378.bat
                                                                                    • Size 722B
                                                                                    • SHA256 32441708aea69b0f03d1a926509f11356d0df6b2fd7a5cb54b896c2d1485f69e
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aD702.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD702.bat
                                                                                    • Size 722B
                                                                                    • SHA256 58d2aa24e322c3b525e27942d77087f145df170d7802a05b6d30d0b2e9d21ccc
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aDB09.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDB09.bat
                                                                                    • Size 722B
                                                                                    • SHA256 343386ea09720eb834cc67a8163b58bf6f91c5f82333cfa073aab7a8688e1bff
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aDF01.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDF01.bat
                                                                                    • Size 722B
                                                                                    • SHA256 8cdc05a783929dbc1bb2b69b064c3889fdba039f99e610e98ad8e4289153a21f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aE1DF.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE1DF.bat
                                                                                    • Size 722B
                                                                                    • SHA256 bd972294f05fd648de53fd27eb6021bb5573279de8d39de271e5b465cdf52f3c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aE450.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE450.bat
                                                                                    • Size 722B
                                                                                    • SHA256 340a97184b3b50a65d6eb61605a57bff5978f1d3af46273671312c22d3364513
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aEB36.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEB36.bat
                                                                                    • Size 722B
                                                                                    • SHA256 461b45cbd7db88a15c9e0d97043bc0ac4b0cbf0a379d1109549b96a43faaf2b2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aEF7C.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEF7C.bat
                                                                                    • Size 722B
                                                                                    • SHA256 116d7b6ee6d9ed72eef021e156d68005a82b8dafeeb9913e428ead5762cdbd9d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aF25A.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF25A.bat
                                                                                    • Size 722B
                                                                                    • SHA256 c4ee44a47fc43d6f8937b02fabd0b7d31b93069f06a600e5fa226c44fb79eb8a
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    $$aF49C.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF49C.bat
                                                                                    • Size 722B
                                                                                    • SHA256 1a7ff07aec2706895977ef7296a2a9cc31c9430047bed3ca7ebf8c86d04c88ff
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.7MB
                                                                                    • SHA256 e5f624ac9d128e9c89b336dd9102a868e4c7b76c45fd7e242f723878e5e7d6ef
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.6MB
                                                                                    • SHA256 b2656d61cd08a72ab8ae33c20d242ad0e4d3e7fac19e61b91f7576d37d392051
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.6MB
                                                                                    • SHA256 e4ce4b3ecbce31e20c840e77b14d7ad720b1e1802852db967d9e20983a723d14
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.5MB
                                                                                    • SHA256 80ac4c4c8c89a2035049fb30308eabbaffcecbd0ee68add969d8a97768db5861
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.5MB
                                                                                    • SHA256 92f63cdbab0225cc142439a15f2f041248ac92c4e561c34ce07e59f8abcb2e00
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.5MB
                                                                                    • SHA256 1005c08e4571797849a0a4299bc69c58d8b600b8facae7064326463873361f61
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 f20512566926928f83d6b49c8a6ebaf466908cc446e2fa4a85b9675978556028
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.8MB
                                                                                    • SHA256 471b215bf5a2409f1cfa2a21696b411e483298aac0ce0f5dd0f98e30b13c8a68
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.8MB
                                                                                    • SHA256 56a02965911c762e8b9db63bb9ea52bbca350e8627df37617fb9174c5a2e273b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 dfee0b7f5a7500927721ca167558bc959cccd8ecd35f30ed2d842be362d65ad8
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 37d6f45881942460edf953dca2207a56a6904a617a2b057d330bafa3a9eb8689
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.4MB
                                                                                    • SHA256 464daa57fa81b3d1fd0780c23e874ad5ecdc7dd409ab51b3ab8ceb7065cd0340
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.8MB
                                                                                    • SHA256 768ce33b0ca2b9897254eb8b6ade421064c4d84688dace78e61c48bf3202a79c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.7MB
                                                                                    • SHA256 c5465508931cbb360c861494c8cc8b140ca1b99f97ec06957c05531e2e4d87f7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 3e7d9ec7365a4eadb65933079cd5aaf0a60a411053424ce0efe5c4d3856260ef
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.3MB
                                                                                    • SHA256 68a4abdeb36b683dfdd6cb9e9a192a1387f44d645d5726680e28be686a445d57
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.7MB
                                                                                    • SHA256 96d4acae8d771aa8dee1c72d20ea9e9cd5c6b6df3aca236230e8050f73a193e7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9af26bf291f0d4a844c2df189dc999ee47ce72cf093a2074ef72be40f7746850.exe.exe
                                                                                    • Size 3.6MB
                                                                                    • SHA256 75132b4fe2865553a0030a14714fc2c210fee20522851dbe9c0e8ee506318bff
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Dll.dll
                                                                                    • Path C:\Windows\Dll.dll
                                                                                    • Size 68KB
                                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    rundl132.exe
                                                                                    • Path C:\Windows\rundl132.exe
                                                                                    • Size 32KB
                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    _desktop.ini
                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-240542094-4193773837-3211495583-1000\_desktop.ini
                                                                                    • Size 9B
                                                                                    • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    memory/208-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/212-2221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/220-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/396-2743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/416-2498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/468-2421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/552-766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/664-2613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/684-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/744-2433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/880-2708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/908-2396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/920-2534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/988-2522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1048-2412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1052-2470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1068-2437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1176-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1352-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1368-2450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1384-2510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1408-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1444-2429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1784-2698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1808-2763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1868-2494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1872-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/1872-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2000-2658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2116-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2124-2574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2132-2542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2240-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2312-2773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2432-2793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2436-2478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2472-2668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2484-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2516-2803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2548-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2612-2758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2736-2643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2792-2673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2808-2403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/2976-2554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3008-2602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3032-2678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3092-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3112-2486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3116-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3120-2798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3160-2783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3184-2753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3252-2733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3340-2633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3344-2374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3344-1620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3344-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3496-2623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3524-2808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3536-2819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3536-2824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3648-2594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3684-2788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3744-2607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3748-2638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3760-2778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3772-2818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3824-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3844-2618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3868-2490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3908-2648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3912-2703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/3972-2566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4036-2723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4044-2768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4100-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4104-2466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4132-2458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4180-2538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4184-2392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4184-2446-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4248-2578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4304-2693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4308-2738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4368-2372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4372-1733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4392-2728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4420-2550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4472-2502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4508-2506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4516-2441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4580-2683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4632-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4704-2748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4740-2718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4748-285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4764-2582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4772-1862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4788-2445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4804-2688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4808-2526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4828-2518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4832-2663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4892-2482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4932-2813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4948-2381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4956-2653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/4980-2514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5012-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5020-2474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5036-2546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5072-2530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5084-2462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download

                                                                                    memory/5108-2558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                    Download