Overview

overview

7

Static

static

3

c510c0d471...2e.exe

windows10-2004-x64

7

c510c0d471...2e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 06:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
  • Size 3.8MB
  • Sample260930-g44vbazzbt
  • SHA256 c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4628
      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5548
          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1072
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60C4.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4160
              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:5852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2560
                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5040
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5700
                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5780
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842A.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2620
                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1688
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BAC.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5088
                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:3360
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D30.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5196
                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:948
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5792
                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5992
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5008
                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:6064
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1704
                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2104
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2616
                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5652
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2380
                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5320
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2384
                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:476
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5096
                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2996
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4936
                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4476
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:616
                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4108
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4460
                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4944
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1188
                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2680
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3140
                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2444
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6052
                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1532
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1644
                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4472
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3340
                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3416
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5788
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5420
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2E6.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4956
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3820
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E0.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4464
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1604
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5144
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4836
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5C5.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1832
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2368
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6AF.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5968
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5984
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1172
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3944
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A3.bat
                                                                                                                              62⤵
                                                                                                                                PID:5344
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3860
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9AD.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5132
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1752
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:3292
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2588
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2480
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2180
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6136
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:200
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:548
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:2712
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE6F.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4240
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2948
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF4A.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:5340
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2140
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE044.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:5304
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4176
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:4416
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2672
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1700
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3720
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE351.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4304
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:3964
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE44B.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:3260
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                    87⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3004
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE517.bat
                                                                                                                                                                                      88⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3444
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                        89⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4192
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F1.bat
                                                                                                                                                                                          90⤵
                                                                                                                                                                                            PID:6016
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1944
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE739.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7E5.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE872.bat
                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:6076
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE91E.bat
                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BA.bat
                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA56.bat
                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4120
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAF3.bat
                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB7F.bat
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC2B.bat
                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2032
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4736
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECF6.bat
                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5468
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:2824
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB2.bat
                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:1008
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE8C.bat
                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3668
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF013.bat
                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0DE.bat
                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3320
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1D8.bat
                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5936
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3AD.bat
                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF478.bat
                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF572.bat
                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:1420
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF64D.bat
                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                PID:1884
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF718.bat
                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3316
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7D3.bat
                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                          PID:704
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:3716
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8AE.bat
                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF979.bat
                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA44.bat
                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB10.bat
                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1960
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBCB.bat
                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC67.bat
                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:5732
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD52.bat
                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE2C.bat
                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEE8.bat
                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:3436
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4256
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFC3.bat
                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11A.bat
                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F5.bat
                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:3812
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5152
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C0.bat
                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5528
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AB.bat
                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:248
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a447.bat
                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a512.bat
                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a106C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1128.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1389.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1425.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1500.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1639.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a187B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1965.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1ADC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                        • C:\Windows\Logo1_.exe
                                                                                          C:\Windows\Logo1_.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Enumerates connected drives
                                                                                          • Drops file in Program Files directory
                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3348
                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                            3⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4540
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                              4⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4460

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            $$a4731.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                                                                                            • Size 722B
                                                                                            • SHA256 48ef4a5747c1f2bc30e578e34cff260a57d182df611f18106e4545ccdb5af55d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a4944.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4944.bat
                                                                                            • Size 722B
                                                                                            • SHA256 579f293683852fa85b6139c4bed8c11431853d119204e594acffcba72af07a2e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a60C4.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a60C4.bat
                                                                                            • Size 722B
                                                                                            • SHA256 c72a07d2e46f8733fa2f064c93f8498e91b8f7b35c071fa62c22f80c90e838fd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a6AB6.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6AB6.bat
                                                                                            • Size 722B
                                                                                            • SHA256 443c29d46ccff8bf6a4cb8db2d774d9b3a4d181fc508a76b8fac143387332f82
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a7749.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                            • Size 722B
                                                                                            • SHA256 7a1898ffd0bb296ae603e0a6648fb1b7771e09d52301a2ac952488786d74582f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a842A.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a842A.bat
                                                                                            • Size 722B
                                                                                            • SHA256 2001ef8740c0a39ff64f209d5555e77073c366df3b80bedaffdf0fec21d9afd4
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a8BAC.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8BAC.bat
                                                                                            • Size 722B
                                                                                            • SHA256 8f372f11cad92b76aa92fe3463b20e577c9d87ca2e6f2b6b027c2cf9e61c317b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a9D30.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9D30.bat
                                                                                            • Size 722B
                                                                                            • SHA256 e0a70ff4d278f188d99995cb39cd42650d827082c8d06312f2890d5fd8ab9292
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a9F63.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                            • Size 722B
                                                                                            • SHA256 d68903fcafb8e3a93e0d745301c014a4c42f25555d6b6c90244536c00423ccbb
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aA37A.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                            • Size 722B
                                                                                            • SHA256 29ada1ffc66a4ce792760182de15f18f4c5fc67328d6097c84a5a751fc7b001a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aA752.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                            • Size 722B
                                                                                            • SHA256 d810b738db32d08bad7fb088babc1f2d378e33125cb82b9d39f68bda96f7ea1c
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aAB59.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                            • Size 722B
                                                                                            • SHA256 ee3776a2c1097a38ac193fa36ed7fc42b1c911564b324f78984c6781da18f9bd
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aAF32.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                                                            • Size 722B
                                                                                            • SHA256 41966eeb6f0ef3eb00163c349069e85946461f0fa5fdfd2acf6f28d1d9bd559b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aB397.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB397.bat
                                                                                            • Size 722B
                                                                                            • SHA256 fe743429eb9330f4274ab9fba898f4be813ef5121c02e675c528904f642f1ef2
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aB7FC.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB7FC.bat
                                                                                            • Size 722B
                                                                                            • SHA256 861f19528ec03981a4cb6619107c795ddc65ff9ea0bcf591fb2c43a21f464a23
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aBC32.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                            • Size 722B
                                                                                            • SHA256 980a4cd001ebba2328a60f034072e81e7bc8abc57708d8e3d2ea511f8c6603ed
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC029.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                            • Size 722B
                                                                                            • SHA256 9da934e3867c5e0fede910d78acafcf0876ef65da6b929c26382cabf9ea804ac
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC3D3.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                                            • Size 722B
                                                                                            • SHA256 52d38353c8e3d817cda88d4b0b0eaaca3f1ec5c00a829f9e5355d7e09f419eb8
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC74E.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                                            • Size 722B
                                                                                            • SHA256 b3d977f3d44720f062a006bdd2e47705704c19af80a471b391a0686bb6aea72d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aCA2C.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                            • Size 722B
                                                                                            • SHA256 645a0d3765e8088ab10e1f062ca63f7de8db96d3c936f49793332a92dbd464d1
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aCD1A.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                            • Size 722B
                                                                                            • SHA256 8c8f91dae73c08603c53d7beb08d33b714f9676cb5345cf26e928b7f20d72d0f
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 0a96f27b449a726bae136a9e8bc7a96971e0e87d2f780fa3545e58f6b2719394
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 d72251b9e2b734cb870c1367bf89950904ad377c20df5dff6a8dd3cfb31db11a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 519d98381438fbb3d54c9fe377e482e21556c0616ca61261868b9d76eae48333
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 72290c3e67df3fef7baf7fe91305ab71a65f964c700489779f55764381edacf6
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 d338bfd9a850fb33046022a1f19f2c800ee0d2fa63430fab390c1b7dd07c1d9e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 45cd28f414acb6ffc3972753709465d31cdb19c4d1137ad6f8f9054959eb7b78
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 9ecba38354964b7a20153d7e00f3c8f8382a0a7fb4ce33dd5aaffe213a268762
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 bb8928e5ed46d74e16dbbf15e8e414d05f7c38d6c0c6ce863d343980af649dd0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 1703827a7ec7e7f603e11bd1e7a76a86632bb28c63f31abc80e0255bcdc1ce6f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 8e1e482b5c6511296915cfc7e906672db3e8940027f80b6026f3d4133fac56f7
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 cc39c95b9c5e18c15de6e612b9b0401e2cccf38b13c1b759481122edfb2e070b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 d8f35ae7bbffde079b9155a4285e0bc96adb98b972f024c143ca9fea3da230cd
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 b253c2f63802f739de2f3b3f2bc75374540d7eb49ec612165ae510ce384e96cf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 986de4103ee0ba9369eb878dd3e398d2de8dc426f3a74ab15c35a91c1058f72d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 8aa94b2111505d9ed8ee170069a1ad40e55a7c84798fe9df56afae5ed05335bf
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 c7c3468fe24a494b7c14bc28724e5c8c27232d5af29b979124466f127e15ffde
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.1MB
                                                                                            • SHA256 e26b985be5051a588018469bc749cb92bc5e5b156e82c1ebb4676fb2a56050a1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 8859dba630e8862b0d4bbf6c8effb76e449cda0c131c3c55fc04ce12a8a72b35
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 9a83afb6f7ef3451e5d9583112c687b93ca9fb17acb06e803d3946cc519d02e1
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\c510c0d471fb67ff1f402b2da90c00ce7c8e109abe65ee06447932f16c2a312e.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 08dd6e9f28b8e667aa9220ce117ec86f473b5212c17570f250421fc7cad576b5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Logo1_.exe
                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                            • Size 32KB
                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _desktop.ini
                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                            • Size 9B
                                                                                            • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            memory/200-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/256-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/432-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/476-8037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/596-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/692-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/948-7982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/948-7987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1008-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1072-422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1140-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1140-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1248-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1312-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1532-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1604-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1688-5998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1752-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1804-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1856-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1864-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1944-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2040-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2104-8013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2120-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2140-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2160-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2180-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2368-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2388-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2444-8087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2588-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2628-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2652-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2672-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2680-8079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2712-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2744-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2824-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2852-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2908-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2948-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2956-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2996-8041-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2996-8046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3004-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3104-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3112-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3116-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3316-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3320-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3344-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-2401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-1804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-6787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3348-8050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3352-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3360-7978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3416-8103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3464-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3552-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3716-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3720-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3808-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3820-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3860-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3932-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3944-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3964-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4108-8063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4148-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4152-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4156-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4176-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4192-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4256-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4300-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4328-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4396-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4400-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4448-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4472-8098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4476-8055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4572-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4676-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4736-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4828-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4836-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4892-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4896-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4904-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4944-8071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4960-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4976-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5040-4090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5048-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5076-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5152-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5288-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5296-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5320-8029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5380-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5420-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5436-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5528-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5628-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5652-8021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5680-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5692-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5732-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5780-5529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5816-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5840-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5852-1809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5936-8300-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5952-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5984-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5992-7997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6012-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6028-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6036-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6036-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6060-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6064-8005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6076-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download