Overview

overview

7

Static

static

3

d3c6cb7dd9...34.exe

windows10-2004-x64

7

d3c6cb7dd9...34.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
  • Size 4.4MB
  • Sample260929-w7tk3sdb28
  • SHA256 d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:8
          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4616
              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5039.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2860
                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4468
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52E9.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3732
                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1104
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54FC.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5984
                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3628
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3760
                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3416
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A1C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3376
                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2060
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:6020
                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2656
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67D8.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3408
                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            PID:4784
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5440
                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4676
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80CF.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5916
                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4140
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8275.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2992
                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4376
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4768
                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1808
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3720
                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4240
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3852
                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2828
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5696
                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1344
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5256
                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5944
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1368
                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5284
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3440
                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4296
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5236
                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1280
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2100
                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3104
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4148
                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4084
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4188
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4932
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9E.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1164
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2204
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB98.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3176
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2912
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACC1.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3412
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5412
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3308
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5704
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEF3.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2468
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4952
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFED.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:6100
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4372
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:4836
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:696
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:2240
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2628
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:5420
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2808
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C0.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:4484
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4128
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:1476
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1452
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2004
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:2768
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1824
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:4648
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA0F.bat
                                                                                                                                                            76⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:5736
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3908
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                                                                78⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2452
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3188
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC22.bat
                                                                                                                                                                    80⤵
                                                                                                                                                                      PID:4780
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:5080
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5464
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5672
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE16.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5432
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4392
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                    PID:4576
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5924
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFEB.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:4584
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:4656
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC104.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:5932
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C0.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:5304
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:712
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1564
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC394.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:1560
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46F.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:2168
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC663.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:1848
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                              PID:2268
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC876.bat
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:796
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC5E.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3576
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD58.bat
                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                        PID:6056
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2D.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD037.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:1304
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                              PID:1080
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1EC.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD306.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4772
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40F.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD538.bat
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                PID:2508
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD622.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD72C.bat
                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD920.bat
                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                    PID:2580
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB04.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:940
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:2688
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCD9.bat
                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF2.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                PID:1984
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEEC.bat
                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3840
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB8.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:1308
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:3292
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0C1.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5724
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:4404
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE19C.bat
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:4920
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:3444
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE277.bat
                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4236
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE371.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:5364
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:2856
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE45B.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:888
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE630.bat
                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEECB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF10D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF294.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF40B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF562.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF60E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF831.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a178.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a243.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                            C:\Windows\Logo1_.exe
                                                                                                            2⤵
                                                                                                            • Creates a file in the Startup directory
                                                                                                            • Executes dropped EXE
                                                                                                            • Enumerates connected drives
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Reads the TCP/IP host and domain name from the registry
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2676
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                              3⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2924
                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                4⤵
                                                                                                                  PID:596

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                Reconnaissance

                                                                                                                Resource Development

                                                                                                                Initial Access

                                                                                                                Execution

                                                                                                                Command and Scripting Interpreter

                                                                                                                1
                                                                                                                T1059

                                                                                                                Windows Command Shell

                                                                                                                1
                                                                                                                T1059.003

                                                                                                                Persistence

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                1
                                                                                                                T1547

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Privilege Escalation

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                1
                                                                                                                T1547

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Defense Evasion

                                                                                                                Credential Access

                                                                                                                Credentials from Password Stores

                                                                                                                1
                                                                                                                T1555

                                                                                                                Credentials from Web Browsers

                                                                                                                1
                                                                                                                T1555.003

                                                                                                                Unsecured Credentials

                                                                                                                1
                                                                                                                T1552

                                                                                                                Credentials In Files

                                                                                                                1
                                                                                                                T1552.001

                                                                                                                Discovery

                                                                                                                Peripheral Device Discovery

                                                                                                                1
                                                                                                                T1120

                                                                                                                Query Registry

                                                                                                                1
                                                                                                                T1012

                                                                                                                System Information Discovery

                                                                                                                1
                                                                                                                T1082

                                                                                                                System Location Discovery

                                                                                                                1
                                                                                                                T1614

                                                                                                                System Language Discovery

                                                                                                                1
                                                                                                                T1614.001

                                                                                                                System Network Configuration Discovery

                                                                                                                1
                                                                                                                T1016

                                                                                                                Lateral Movement

                                                                                                                Collection

                                                                                                                Data from Local System

                                                                                                                1
                                                                                                                T1005

                                                                                                                Command and Control

                                                                                                                Exfiltration

                                                                                                                Impact

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                $$a4637.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 40662d5f5390713cd8af692684404fff9fa3dd12a69bbb69beca49abc15a43de
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a4B67.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 cfbe628bf42af0398bd8414340b2f0f0f6bb6d919c0d8eab8139407b8e30a1db
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a4D2C.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 f5f24d513636cdb82a3c1bdcdb22fd5f2d2f0cf0ab2d1534f8d692fa12e8f7c2
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a5039.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5039.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 359509e0d7c73f099ea31c2b91b43d9ada620ccf57865925b2e80b1d1a7d3b76
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a52E9.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a52E9.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 7dc2d5f254f9d8c0e8a01fbdd3bd9d18ad7356d36b2ac5b293754818131d9a3c
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a54FC.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a54FC.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 45a0430e803d842178e2c0aedd052e95c4dc38aa7f0994284eee02da4739ec85
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a576D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 ea72af340702c5146e960f91ee1abfe3f3628f9c038bd0ea0c7f18f954b0b153
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a5A1C.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5A1C.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 18ef47f929aada344dfee13e9ead8e919f7a3a3dcc860a2090f4b6fb91d3fff5
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a5E53.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5E53.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 aef76f44dc494227aa064510456c81f1488ee76904515778c2ac954be229b5a7
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a67D8.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a67D8.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 0efba2cbf3390576da5cb984ddd7592a74a0b32331548772c14dc6b256379bcd
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a80CF.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a80CF.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 1f3790b100219d762b47fdac011d3c802093a5c1d36739efc198275a01e96325
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8275.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8275.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 fa88cf064183448fd44e798fa9b1bf820ae946415754267dabbf548234d7e68e
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a894B.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a894B.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 c53d1e76078d8dc4cad42be7fed2b2341678c160740a6766a00be61272c3d329
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8B6D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 ff3aeea7b24a9baae3926020b60ddfd117070d502bdaf013385d4a4def9be019
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a8E0D.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 2ffafc7b94b0f5a053f83bfe5487b1952de5a656844b388ba1be845f56f9886d
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a908E.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a908E.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 a1247f11ed821523801474d8ed490500b42d2d5511359c7761f9b9b3dca6156c
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a984E.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a984E.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 f62a0ead68e5a8b471bc61ed3a1a492859a22afa56cefecfcb12b0d9b142ab9e
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$a9DBD.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 1ccdfa28dfaeb6f39440ecaf13a24ba50778e010b037fbf68e6e70e093448ae9
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA02E.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 07ed6d365bef0966aafc629514eb4413caf345aee4609b28ba1a28bb861afdf3
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA29F.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 b300f5dc7395c083ca07f6e09386e77db4ea41bd7090de7fa9701798ee5bc814
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                $$aA4E1.bat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat
                                                                                                                • Size 722B
                                                                                                                • SHA256 f8e5a0b2a74ab2ad8e26b6fda26423f36e33250d22fb50ca122ba6fb823c89af
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.0MB
                                                                                                                • SHA256 889c1ffa4023d77df400616b781afcbd4b649fbef08e8e2ab36dabb3bbf4d08f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 c76203f960415b8e038f50907a32ce567901b7f40b52653f02f6acb066554a3e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 7339d3075765985a1036c967e00206f93fc234cafc15d5d4279b76ebfdc7f9f0
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 de99a4f83eea2394c7769ff496a021282a50d1d9bfb53937d4415f392c5ed682
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 8b23dd2e91ee867ad94d96900c29f2981b915621051006788eb20812d079b3be
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.3MB
                                                                                                                • SHA256 7a2b0ea0d1b2e07d1de304149d866f41be8101fb7103e4f5334958d07b5a325a
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.3MB
                                                                                                                • SHA256 2e76a5df010c1fc92d241b4d0921f3a1ee19bc14f4a70460315e1f26871dba01
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 32f67bdc56f63377d975d89dacd1585fb325882c9293d7f09f307ebc2e5dc8bc
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 4519f027b4b5ad558bcc2e5fcd00ad97aea61aedb473396ec6560b2b99b5a6a7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 3fb46ba5d552c0e15d348622207d98dd8b631be096be0982ed163524fda9d93c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.3MB
                                                                                                                • SHA256 4b2ed57f84baefbdb363f4c53f61104c2ec866d6551253fbfbf7f80ab8588b7c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 f2ab66dd8a6b0330086f113137881c3040827c551550cc71dc82c2ce6546a0f9
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 5b77c76285ae4fa9af881ae628daf7200ce3dbe222f804e955f3741dbaf60094
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.2MB
                                                                                                                • SHA256 1d0e0e502e3ee3753a076a1ca6e527d376cd1ef521cf4c3bbe97ab34ef446e57
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.0MB
                                                                                                                • SHA256 00952ea880680e383811e0a8be8457406005dbc68a33ca265bd866fca5503bb7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 4.1MB
                                                                                                                • SHA256 10b830f3a98686b9f0e3af12be00683240c30a2797cfaa64ba50964efcca1daf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 ab6339835a1ee80d675b5717b3af48b9d1fa5e561a423541536a6c182a0d8d1d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 3b8639538fca238b668f96aba87051281d68d1f3102f8f2902da40cd3b1abf67
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.8MB
                                                                                                                • SHA256 ddbd34e2d6f0d8c79144b40036b77a32c063b4ae68e0d7f733ad0bace47bcdbf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\d3c6cb7dd9073063b90212e8393b818715fb55c01474cba7b222b1251b902334.exe.exe
                                                                                                                • Size 3.7MB
                                                                                                                • SHA256 86e4e05a8fc0fa30a137ea3622ebee68539e4a5d9a8df7b7a261809bfe399fa8
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Logo1_.exe
                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                • Size 32KB
                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                _desktop.ini
                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-696679853-3915825385-3233721679-1000\_desktop.ini
                                                                                                                • Size 9B
                                                                                                                • SHA256 838cd29e86a897cab4f24311178626216bfb2c78875e82ccad2f629039bcbc8e
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                memory/296-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/456-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/696-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/708-8676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/720-8280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/796-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/888-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/928-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/940-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/956-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1104-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1124-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1188-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1240-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1280-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1320-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1344-7274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1436-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1452-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1500-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1560-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1564-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1680-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1712-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1808-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1848-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1992-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2060-280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2116-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2204-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2232-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2340-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2424-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2476-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2484-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2572-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2612-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2620-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2628-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2632-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2656-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2676-7157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2676-750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2676-2252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2676-8200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2676-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2688-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2708-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2728-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2768-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2788-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2808-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2828-6073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2856-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2900-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2912-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2996-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3028-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3104-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3152-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3188-8205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3292-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3316-8628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3328-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3388-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3416-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3444-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3552-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3628-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3836-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3840-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3908-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3952-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4084-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4128-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4132-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4140-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4144-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4192-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4228-8285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4240-6065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4256-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4296-8105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4372-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4376-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4380-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4392-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4404-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4460-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4468-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4504-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4504-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4536-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4544-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4648-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4656-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4676-5568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4688-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4784-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4792-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4800-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4864-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4892-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4928-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4932-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4952-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5060-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5080-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5136-25-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5284-8095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5292-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5344-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5412-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5488-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5672-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5688-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5704-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5716-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5768-8235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5804-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5816-8295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5828-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5872-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5924-8225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5944-8087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5948-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5948-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6004-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6012-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6044-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download

                                                                                                                memory/6064-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                Download