Overview

overview

7

Static

static

3

d3c6cb7dd9...34.exe

windows10-2004-x64

7

d3c6cb7dd9...34.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/09/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
  • Size 4.4MB
  • Sample260929-w7tk3sdb28
  • SHA256 d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5E4.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF817.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC2E.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5032
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a332.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2992
                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5312
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22C1.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5356
                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5620
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CED.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5652
                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5696
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5740
                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5860
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BB0.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5900
                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:5984
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7035.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:6012
                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:6068
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:6104
                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2448
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75A3.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4332
                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4668
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a792E.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4556
                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2364
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3332
                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2268
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F38.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3848
                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3964
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2132
                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2312
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a863D.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1948
                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1772
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4680
                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5244
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5216
                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5132
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4272
                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:948
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4076
                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3680
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92A1.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1448
                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2332
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a939B.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2108
                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4420
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9457.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2528
                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5324
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9512.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5428
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2308
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95ED.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3252
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4992
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9699.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4384
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:692
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9735.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5624
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5676
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97E1.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5732
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5660
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98AC.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1708
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5920
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9968.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:5744
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:6000
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A33.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:6060
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5976
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ABF.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:6088
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:6108
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4100
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:6128
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C07.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5848
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4568
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C94.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:376
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4660
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D30.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1224
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:4268
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:4288
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1404
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:2424
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:412
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:4180
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4176
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FB1.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:3436
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:1348
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA06C.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:5208
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3624
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:5144
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:5176
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4336
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4280
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:3256
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA399.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:316
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA445.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5472
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA55E.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:1164
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1220
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5608
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                              PID:5684
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA87B.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3612
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA946.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:5780
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9E.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1012
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB98.bat
                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3076
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC24.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                          PID:1812
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3220
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADAB.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                        PID:5076
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEE4.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:1676
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                        PID:732
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0E7.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3528
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:816
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB329.bat
                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                  PID:32
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB423.bat
                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4B0.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:5484
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1632
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                      PID:5404
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:5928
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:4480
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA9C.bat
                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB76.bat
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCFD.bat
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:3912
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDC8.bat
                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:2248
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4592
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE74.bat
                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC317.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC71F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD23A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD567.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD75B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD93F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                        10⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Enumerates connected drives
                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:5372
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                          11⤵
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:5436
                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                            12⤵
                                                                                                                                              PID:5480
                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4684
                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3792
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                              4⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3368
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 752
                                                                                                                            3⤵
                                                                                                                            • Program crash
                                                                                                                            PID:4272
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 752
                                                                                                                            3⤵
                                                                                                                            • Program crash
                                                                                                                            PID:3984
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4684 -ip 4684
                                                                                                                        1⤵
                                                                                                                          PID:5132
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4684 -ip 4684
                                                                                                                          1⤵
                                                                                                                            PID:1960

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                $$a22C1.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a22C1.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 4d61c39655de721e3a2013f53f80ef21432a528dc993978b48d38d1b8c7e312b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a332.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a332.bat
                                                                                                                                • Size 721B
                                                                                                                                • SHA256 8690493614418ed038f8f69d85d8ecfb0abd9183e0738833fca626232415a616
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a4CED.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4CED.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 99cee44d2cf5af13eb6a658cbec94ecd9f1db113c260c8575dd27055ed73a5f1
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a61AE.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 0dde1ccd99b8a0359d094c6fda0ab40e438708639c7e6b5eb1c1f665c98098ea
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a6BB0.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6BB0.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 ea033c5e313431820511441558be391272ce0edf3d69c2fe626d969af1c850ea
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a7035.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7035.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 1c74c7ca20ada070adfca65cebc1b01ba6e67b1728571e03c8092becf4c8371d
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a7371.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 1a32074622a1145f17842998cb2e625e590a3009b848e67a86ea1f2ece72b40b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a75A3.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a75A3.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 a25cf444caef21b6cdaedbe770602cb00dcc464922a6f4f44e69354bf1a6a54d
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a792E.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a792E.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 a95a15c126415f9b313d4b226c90baf2d413793d6823624f36aaf080a3af712f
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a7C4A.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 f952af346cea920451db89f08f8708cd93764ffcd7e094d359f871c1f11d1133
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a7F38.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7F38.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 e8bf8009897b797b27f2795fba3e1cb63aec489afa1805022a1264011d19ef9c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a82B3.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 ba11939693ed526c5503161bd3aa5d62f4a2da2b2d9531f9b3bebe557d9ba4ad
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a863D.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a863D.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 a71d9006c353dd9e6e27b8d5bebaf454b643acba897300b8da61642bca508c74
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a8776.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8776.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 9fb675b10d62af1a8fd7adce6249014fd840e2530eefc74fcd932f666b2000c3
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$a8A16.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 6c614f5f88e07cb2bf17f5e3ec253150ed46f6824c84c185a83c5626b4675fef
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$aF5E4.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF5E4.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 3e7081321a296b717fb5ff7b7b469702248cc945539986ec96fa905707a640e6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$aF817.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF817.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 cf38c93baaa7835af47ef43ce36979390915654ee96bf917064ebf14c1975a1b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                $$aFC2E.bat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFC2E.bat
                                                                                                                                • Size 722B
                                                                                                                                • SHA256 ad07d1bc1465cc601f0140b69be4fea738e78f39dbceffa1c5c534b403e33757
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                • Size 4.2MB
                                                                                                                                • SHA256 4519f027b4b5ad558bcc2e5fcd00ad97aea61aedb473396ec6560b2b99b5a6a7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                • Size 4.2MB
                                                                                                                                • SHA256 5b77c76285ae4fa9af881ae628daf7200ce3dbe222f804e955f3741dbaf60094
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.3MB
                                                                                                                                • SHA256 7a2b0ea0d1b2e07d1de304149d866f41be8101fb7103e4f5334958d07b5a325a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.3MB
                                                                                                                                • SHA256 4b2ed57f84baefbdb363f4c53f61104c2ec866d6551253fbfbf7f80ab8588b7c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.3MB
                                                                                                                                • SHA256 2e76a5df010c1fc92d241b4d0921f3a1ee19bc14f4a70460315e1f26871dba01
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.0MB
                                                                                                                                • SHA256 85e40d0a2bbec8726010d835f1c89a24c2336aadbc503acb56af40604d0f5c56
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.2MB
                                                                                                                                • SHA256 3fb46ba5d552c0e15d348622207d98dd8b631be096be0982ed163524fda9d93c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.2MB
                                                                                                                                • SHA256 1d0e0e502e3ee3753a076a1ca6e527d376cd1ef521cf4c3bbe97ab34ef446e57
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.1MB
                                                                                                                                • SHA256 f2ab66dd8a6b0330086f113137881c3040827c551550cc71dc82c2ce6546a0f9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.1MB
                                                                                                                                • SHA256 10b830f3a98686b9f0e3af12be00683240c30a2797cfaa64ba50964efcca1daf
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.0MB
                                                                                                                                • SHA256 00952ea880680e383811e0a8be8457406005dbc68a33ca265bd866fca5503bb7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.1MB
                                                                                                                                • SHA256 32f67bdc56f63377d975d89dacd1585fb325882c9293d7f09f307ebc2e5dc8bc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 3.9MB
                                                                                                                                • SHA256 ab6339835a1ee80d675b5717b3af48b9d1fa5e561a423541536a6c182a0d8d1d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 4.0MB
                                                                                                                                • SHA256 889c1ffa4023d77df400616b781afcbd4b649fbef08e8e2ab36dabb3bbf4d08f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 3.8MB
                                                                                                                                • SHA256 3b8639538fca238b668f96aba87051281d68d1f3102f8f2902da40cd3b1abf67
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 3.9MB
                                                                                                                                • SHA256 c76203f960415b8e038f50907a32ce567901b7f40b52653f02f6acb066554a3e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 3.9MB
                                                                                                                                • SHA256 de99a4f83eea2394c7769ff496a021282a50d1d9bfb53937d4415f392c5ed682
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                                • Size 3.8MB
                                                                                                                                • SHA256 7339d3075765985a1036c967e00206f93fc234cafc15d5d4279b76ebfdc7f9f0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Dll.dll
                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                • Size 68KB
                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                rundl132.exe
                                                                                                                                • Path C:\Windows\rundl132.exe
                                                                                                                                • Size 32KB
                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                _desktop.ini
                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-1696934516-3600988056-1840298893-1000\_desktop.ini
                                                                                                                                • Size 9B
                                                                                                                                • SHA256 838cd29e86a897cab4f24311178626216bfb2c78875e82ccad2f629039bcbc8e
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                memory/204-2275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/316-2090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/320-2447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/412-2058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/636-2427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/692-2008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/772-2164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/816-2174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/948-1980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1012-2130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1040-2204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1064-2412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1164-2102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1220-2106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1348-2066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1404-2054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1540-2150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1572-2355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1676-2159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1772-1962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1872-2350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1960-2270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2032-2295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2260-2290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2268-1941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2284-2453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2284-2458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2308-2000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2312-1955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2332-1988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2364-1934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2372-2146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2384-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2396-2154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2448-1920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2468-2199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2512-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2680-2340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2912-2365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2924-2360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2928-2086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2948-2330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3064-2285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3076-2134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3088-2417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3220-2142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3248-2194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3256-2082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3368-2335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3528-2169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3608-2432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3624-2070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3652-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3652-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3680-1984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3740-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3788-2452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3824-2437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3844-2422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3912-2244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3964-1948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4056-2375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4156-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4176-2062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4260-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4268-2050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4312-2260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4336-2078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4420-1992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4436-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4480-2224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4568-2042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4592-2249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4620-2254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4640-2370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4660-2046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4668-1927-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4684-1855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4684-1853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4684-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4840-2345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4912-2407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4972-2209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4984-2138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4992-2004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5012-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5028-2325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5032-47-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5132-1976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5144-2074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5184-2265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5244-1969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5312-1867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5316-2094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5324-1996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5344-2280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5368-2184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5372-1876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5372-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5372-1877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5372-1909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5400-2110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5472-2098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5496-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5504-2310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5524-2189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5612-2380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5620-1883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5648-2385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5660-2018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5660-2014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5676-2012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5680-2395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5696-1890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5756-2114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5768-2305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5852-2300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5860-1894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5860-1898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5876-2315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5908-2320-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5920-2022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5928-2219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5976-2030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5984-1905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5992-2118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6000-2026-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6008-2214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6040-2229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6064-2126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6068-1913-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6080-2122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6108-2034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6128-2038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6136-2405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                Download