Overview

overview

7

Static

static

3

2a40efa45c...91.exe

windows10-2004-x64

7

2a40efa45c...91.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/10/2026, 12:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
  • Size 3.8MB
  • Sample261011-p11bqaaa34
  • SHA256 2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4B.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5564
      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6D.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3760
          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5832
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1207.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3696
              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3824
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1505.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4212
                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4652
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a189F.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5080
                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4836
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BEB.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5320
                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4228
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F94.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5316
                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5188
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23AB.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1800
                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2112
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a287D.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:768
                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4176
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D40.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3220
                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5288
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31A5.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5092
                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4240
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3714.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5200
                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5232
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1332
                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:216
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1788
                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4484
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a483A.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1904
                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6052
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3984
                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3752
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F10.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4052
                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4828
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52AA.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4272
                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5820
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5809.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3268
                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6100
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CFB.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:380
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5660
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D59.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4568
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4512
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DB6.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3332
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4100
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5908
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4812
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E81.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1856
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5880
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED0.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3640
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4340
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4756
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3152
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F9B.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4840
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3488
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4604
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5028
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6056.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3516
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1128
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
                                                                                                                          60⤵
                                                                                                                            PID:1432
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:6108
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6141.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:5220
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2016
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a618F.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:3756
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3892
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61FC.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5920
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2024
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a625A.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:3728
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:652
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:680
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1852
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6325.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:4848
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:916
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2216
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5836
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6400.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5024
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:5060
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a644E.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1944
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:4344
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64AC.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1104
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4804
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6509.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:5032
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1420
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6577.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3276
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5876
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65D4.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:2264
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3628
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6632.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4124
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:2336
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673C.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4316
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6817.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:736
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2612
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68C2.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6920.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:3956
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1768
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69CC.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:3240
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A59.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5348
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:4016
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B05.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:3904
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B53.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BA1.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BFF.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C4D.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1556
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D08.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4976
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5772
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D66.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                          PID:5308
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DB4.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5364
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E12.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:5760
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E60.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5036
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EFC.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F79.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7025.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                  PID:2188
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70E1.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4112
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:2504
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71FA.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:4516
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                              PID:640
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7277.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:6032
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5464
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7323.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:5108
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73CF.bat
                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a741D.bat
                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:1308
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a746B.bat
                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6024
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74C9.bat
                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2236
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7611.bat
                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:456
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76EB.bat
                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6136
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77A7.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2988
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7862.bat
                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a790E.bat
                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a799B.bat
                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BDD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C6A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a812C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a817B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5768
                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                    26⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1180
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                      27⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:4192
                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                        28⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4016
                                                                                  • C:\Windows\Logo1_.exe
                                                                                    C:\Windows\Logo1_.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Enumerates connected drives
                                                                                    • Drops file in Program Files directory
                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1096
                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4020
                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                        4⤵
                                                                                          PID:2188
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1012
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:2772
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1032
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:4236
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1096 -ip 1096
                                                                                    1⤵
                                                                                      PID:1976
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1096 -ip 1096
                                                                                      1⤵
                                                                                        PID:5796

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            $$a1207.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1207.bat
                                                                                            • Size 722B
                                                                                            • SHA256 d11dca8fcf3b77b78e7715dbc45206eb0c32c1be4b4b82f062dcbf90fb399cbb
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a1505.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1505.bat
                                                                                            • Size 722B
                                                                                            • SHA256 f0a66c3e5024a3a0cb8616b2905c5a4c90faca054d8a469dcb3113f612782044
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a189F.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a189F.bat
                                                                                            • Size 722B
                                                                                            • SHA256 c8d4012a28c391a044ba057232a82bb016700d8300efa7e699ca6227dc314d6e
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a1BEB.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1BEB.bat
                                                                                            • Size 722B
                                                                                            • SHA256 c77d41b8c269b154958bb628433bfa6486be533fd751b16ded540373982efe11
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a1F94.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a1F94.bat
                                                                                            • Size 722B
                                                                                            • SHA256 329d1309099903910b6dcceca90da3b086af07f6dfd69a9d821e3b7bd620d625
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a23AB.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a23AB.bat
                                                                                            • Size 722B
                                                                                            • SHA256 8fef95cb8c1e8af0867330112277489437bddbaa7b8649df7e5661d574e486ea
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a287D.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a287D.bat
                                                                                            • Size 722B
                                                                                            • SHA256 22d65ae8016025eb052079fb84fbacf00bb909abb76101c9f375d0344f4b6cd8
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a2D40.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a2D40.bat
                                                                                            • Size 722B
                                                                                            • SHA256 afdedeee89ec4733ab5ad7930ae1b14630bfd0296a863b45ba5b816225e26a4d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a31A5.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a31A5.bat
                                                                                            • Size 722B
                                                                                            • SHA256 039d8363778280cb49722f7e1de174ece2a88d6b6ec6bef4fe4c16017725ac42
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a3714.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3714.bat
                                                                                            • Size 722B
                                                                                            • SHA256 4173ca1d8f797adc347d9a05b0780c12cdb64750bbce4f8077432362bf785d63
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a3C82.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3C82.bat
                                                                                            • Size 722B
                                                                                            • SHA256 fa6ce1f2a21e833a1389e37c9788899f1d9e98cfca8f9560e69a93ccfaca1cb1
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a41D2.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                            • Size 722B
                                                                                            • SHA256 881402acce21969a61d7e08443f1936b5a29a5c6efca84b05424fdfc26074e56
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a483A.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a483A.bat
                                                                                            • Size 722B
                                                                                            • SHA256 e47131de9688922000ca3a0345fc626f1dbc0df598a6487deeb28cb86aaea169
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a4B67.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat
                                                                                            • Size 722B
                                                                                            • SHA256 7f6ea3ee46cc3512986c30cf978011dcf7fa630e9fca7419115a48aa8acae329
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a4F10.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4F10.bat
                                                                                            • Size 722B
                                                                                            • SHA256 1b7a3a7337ff6ae1ba51df1cccc56b687ed21052a15c33ef38fe199487143dc0
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$a52AA.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a52AA.bat
                                                                                            • Size 722B
                                                                                            • SHA256 5175aa22500d8c768de6b1e1bbf29cfcc2ee1c01b4a8d8261e19b16b91ee429d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aC4B.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC4B.bat
                                                                                            • Size 721B
                                                                                            • SHA256 11c3763a492a0a377297e31f30a9114687185ef318ffdf035431be14cebde2f5
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            $$aE6D.bat
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aE6D.bat
                                                                                            • Size 721B
                                                                                            • SHA256 f7344b07fc3dae4ad39f9520b53857d08cc3a2c1e0c2f36c2754cb0fd9686358
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 f67d1e9702ed8b3466e09dd162e0877eb1366dfb73ed11d23d60d622efd31790
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 606854967330905a3ebfc5bfd3d10eb64d8ec25f9a185576b563d26f0c7c5d4f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 59eddd5d6632b7967580d4687f4898fa9262cc296f70d55b079401777ed4c7a0
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 59cfc63c1816a49a5511d569b192a0fc539c776da9c924d8439df5c7e40e74d4
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 26f1fe5e5ad4e91327f9ec05a5ea1945f30b2f40b95852556a42c1565d75b29d
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 1270ef36b7042573f85cbb9bb295d3c9870720499ff723d516c89ee1057e5f2a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 3c6235112edebe0b3174c02d37f150aa8b013025504d3caf39d44d7111a487ae
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 eb91e3e959e516caf97ff08d3499d77903a9ed6cdc689a4b0051aba05f22078f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.7MB
                                                                                            • SHA256 5d26e34024f3b90132f0bf1425e758ed3493967298011a4235a2c4443064380b
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.5MB
                                                                                            • SHA256 d3bb100d1b326491c3a21e0ae7e541b86d95b58384cdd85bb4ee0ab2acb57fe5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 2947b053fbcca335c0493ad88d890ef41397bbce3d80ba18dc43f60411d93054
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 105513b6cbda09141db6326b24eb4d1c1263b8bd935b2fc8d43e1a611777ce5f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 9e30b0169ec5e3776dcd5a812b7703a490a139a6295db59e8c51e15aa9078343
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.2MB
                                                                                            • SHA256 e04ecb6967399a673598f5e6e4205e8934c88e7c26ca0850b85c89c164fcfa8f
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.6MB
                                                                                            • SHA256 2c8f31eff5eadec4d5a4b73a3460e90fce433e7a40098e64fdc638233b6a9e47
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.4MB
                                                                                            • SHA256 54209edf718b5bfe722fd2df139fb9445510c661558df8feac450387295e7986
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 559a6da3d88e285a449b9df3ca824dba5814a51a68a47508c9021972d69acc82
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2a40efa45c36ab15fcb4fd247bee1dcea96a97d501e3c82171b3a2d84b48b491.exe.exe
                                                                                            • Size 3.3MB
                                                                                            • SHA256 a7e70f7d092609408c0de0954bd53f680b420993da549e0f255704ddc7f2f9b5
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Dll.dll
                                                                                            • Path C:\Windows\Dll.dll
                                                                                            • Size 68KB
                                                                                            • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            Logo1_.exe
                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                            • Size 32KB
                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            _desktop.ini
                                                                                            • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                            • Size 10B
                                                                                            • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            memory/216-2986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/452-3448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/456-3346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/640-3292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/652-3110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/916-3120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/960-3328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/968-3256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1096-2951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1096-2961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1096-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1096-1896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1124-3430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1128-3085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1180-3122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1180-2972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1180-3030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1248-3262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1264-3358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1420-3146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1528-3460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1556-3231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1768-3186-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1852-3115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/1976-3412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2016-3095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2024-3105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2104-3226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2112-1714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2164-3216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2188-3280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2236-3340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2336-3161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2504-3286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2560-3490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2612-3171-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2664-3400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/2888-3196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3152-3070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3264-3442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3384-3221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3484-3274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3488-3075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3504-3310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3628-3156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3752-3009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3752-3013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3824-47-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3892-3100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/3904-3211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4048-3478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4100-3050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4176-1903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4180-3370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4216-3472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4228-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4240-2958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4252-3241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4316-3166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4332-3466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4340-3065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4344-3136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4364-3503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4364-3498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4468-3406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4484-2996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4512-3045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4644-3388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4652-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4672-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4672-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4680-3268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4764-3181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4772-3496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4804-3141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4812-3055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4824-3484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4828-3021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4836-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4868-3191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4880-3316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4888-3382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/4980-3364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5028-3080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5060-3131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5088-18-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5108-3304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5128-3334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5140-3394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5188-728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5192-3418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5228-3176-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5232-2974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5288-2405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5348-3201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5464-3298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5540-3436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5620-3454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5660-3040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5688-3246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5720-3322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5748-3376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5760-3251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5772-3236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5792-3206-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5820-3029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5832-32-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5836-3126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5876-3151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/5880-3060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6052-3004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6100-3035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6108-3090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6132-3424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download

                                                                                            memory/6136-3352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                            Download