Overview

overview

7

Static

static

3

937d940e12...c8.exe

windows10-2004-x64

7

937d940e12...c8.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/04/2026, 08:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
  • Size 4.5MB
  • Sample260424-kkpg3adz6n
  • SHA256 937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3757.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4396
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a391C.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4132
          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C97.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4968
              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3176
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F37.bat
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3112
                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4344
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4205.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2700
                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3332
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a464B.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3584
                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5016
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D02.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1852
                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5112
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56D5.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3152
                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:580
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a607A.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3940
                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2388
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D3C.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:468
                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1528
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a702A.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3320
                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4340
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7347.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2348
                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1788
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7606.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1016
                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1144
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7903.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5004
                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3280
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D68.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3840
                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4084
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E62.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1480
                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2228
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83F0.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1596
                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3868
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8652.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4324
                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4316
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D57.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3744
                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4908
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9064.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4860
                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4432
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9371.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1180
                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2548
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95E2.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4288
                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1048
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96EC.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4992
                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4912
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9815.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3248
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3684
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a998C.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2672
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                        51⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3440
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B12.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3600
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4872
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BAE.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1908
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4692
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C3B.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2716
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2492
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D45.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3388
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:584
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1F.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4484
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1684
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EDB.bat
                                                                                                                              62⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:948
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1608
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F87.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4108
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1268
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA090.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2164
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1796
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA12D.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:2632
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2324
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA227.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:3748
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1680
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA301.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:1452
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3536
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3FB.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:4552
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:4212
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C7.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:3284
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:2760
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5A1.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:1552
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:464
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61E.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2252
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4260
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6BB.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:3452
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4428
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA766.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:1484
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:992
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA812.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA89F.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:3756
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA97A.bat
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                              PID:1760
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA35.bat
                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:3416
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB2F.bat
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:3400
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC48.bat
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD42.bat
                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE1D.bat
                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:1896
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEB9.bat
                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4168
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF65.bat
                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB030.bat
                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                          PID:3908
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0DC.bat
                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB198.bat
                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                      PID:1636
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB263.bat
                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F9.bat
                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                PID:1488
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB503.bat
                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                      PID:3876
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5AF.bat
                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:396
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB67A.bat
                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4032
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7B2.bat
                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:1272
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2600
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB949.bat
                                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9F4.bat
                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAA0.bat
                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB7B.bat
                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC17.bat
                                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                                              PID:960
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCC3.bat
                                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                                        PID:2776
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8E.bat
                                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                PID:2588
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE59.bat
                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF6.bat
                                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF92.bat
                                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC04D.bat
                                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC128.bat
                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3768
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1B5.bat
                                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2AF.bat
                                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:848
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC36A.bat
                                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:2568
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC629.bat
                                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2456
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC704.bat
                                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:392
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC86C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC927.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD05B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD155.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD230.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD53D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD79E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD84A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD925.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE078.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE25C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE337.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE54A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE78C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE848.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE923.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC7E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF047.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:4748

                                                                                                                                                                                                              Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    $$a3757.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3757.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 47a2b76649d03e38ea488abe23f9264d329ecbd7763f52f5df4e710fbca1c63e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a391C.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a391C.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 601821cc0277447a625b2ed15a67e94bed3a4fa219d41ef72992680e833fcecf
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a3C97.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3C97.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 14edb96357fd8668ddd446dfe0d1c51a4d77db91f36a60f5b7bb46f69ba6026b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a3F37.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3F37.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 5e99260478cb5c0d370736f2028db52f40303792573fad007271679e6ecf9c54
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a4205.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4205.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 78c25fa4a3eb3d211de57623f1c641a7ffeaefd4cb4e626fd209ed0b6a2ee4c2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a464B.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a464B.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 4e13e573220479d61a169d65e33e612b87e4419a8e7a54d5c99d3efc40590d9c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a4D02.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4D02.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 8a30cf10c88e9cab0efd1b92371332329d8670bd1928cf621df8fdf981dfd1c0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a56D5.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a56D5.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 264ba0549bb3c2df0389fe086bfc32e957f77daf765078b2d528df91aaa595d8
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a607A.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a607A.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 85fb2504095741dd8db6a99704c00c06548fafefe7c81287f4573992ffcdf6b8
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a6D3C.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6D3C.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 451c0cbc0399b38814bc258375d39d5db2cacadbf3a45cbec17c3320dacce93a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a702A.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a702A.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 cb9b940c451593a14e1d488e7050f2bc7752ab9407906a21ea911eaafb65e7ef
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a7347.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7347.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 ed78121152b5197052935d98491d5568b5370f88f67cb4fdb6ef33a6b01dfed7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a7606.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7606.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 736bc9fcaac738973a82c891154f7b1d6f994fd5500345e1ab429b9ab29e3286
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a7903.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7903.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 2cb5f6e34079583b921b84600834c25f7326d9a8b4b791260588cf9a308cc46d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a7D68.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7D68.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 f7d4f2063fbb808bc754c471c31e07298e6de2bea0d22f059fadeba148dfb215
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a7E62.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7E62.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 195a98ece9255282fb5952159aad78fbf3a8903507dafa0425e5f4f3ceb21bab
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a83F0.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a83F0.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 5c70d722f20a5492f98314b057e3ed446902674f6ebf36c8f24321fd2fef8639
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a8652.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8652.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 d124609186d57b690e281746c7a801fab771d2d97cb77c3dca118b00610a99e2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a8D57.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8D57.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 a96f79d825beb0399289568ecdc08978720b858ad61ec39aa13df8a8b3bc91bd
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a9064.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9064.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 de5ba31a43728458cef6f22c24075270fa209cb6b0b931378a78327511887ba4
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    $$a9371.bat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9371.bat
                                                                                                                                                                                                                    • Size 722B
                                                                                                                                                                                                                    • SHA256 2447f38e0d90e786fb2d411253c0f404e3309a8bf25c01912de0edf6d1e655ca
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe
                                                                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                                                                    • SHA256 aa74eadf0be2eee7acd696736b28315d41bad81ba53e364ced8981fec5053577
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                                                                    • SHA256 8e6828000f4c9d315cb999235eec67866d05fcdc4faa9b307c063e4dfc7363d6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                    • SHA256 f4df8194bcdbf6733e4a66b173f1e1c373e3b2d72d2ea3737d110476295c4ee8
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.1MB
                                                                                                                                                                                                                    • SHA256 3815de3c905d0f139935ef94d4d6799aae797774e774a9c2a6029ce9db69c4fc
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.1MB
                                                                                                                                                                                                                    • SHA256 4f79c89303ccea8ea14bf1070277f77220e45d367ab65d1ad8a0eb53797591f9
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.1MB
                                                                                                                                                                                                                    • SHA256 5bcb1a30e068d818f2a01295a9f3757f58b0844243dda6b790e559e3231dc41c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.0MB
                                                                                                                                                                                                                    • SHA256 da922a9b99427d6ef03d85d7219b68ce4f0620763a1f993933b0e85dd9b035e2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.0MB
                                                                                                                                                                                                                    • SHA256 156b120c23e37b1c7de05645aaad8f0b15fbf100926f05b68f1acd1461ebdc65
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 3.9MB
                                                                                                                                                                                                                    • SHA256 7eb5a9fc2fd3b52953b5e24563622b4b2f972c5b527be8154a960d2ffd132de0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.5MB
                                                                                                                                                                                                                    • SHA256 1d41cad45866b4234709315b7fc7b9e2884d2b768844a970ed0abf71ac37b17f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                    • SHA256 5efed4fb87a03033b06d810ccf2e4ae70adf464aa5e4e4aa0879b3356a4adb1a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                    • SHA256 5d0211b51421c7731a0353bec5e437c4f78ed59ac267dee2e2f3abe512df2cbf
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.0MB
                                                                                                                                                                                                                    • SHA256 fd84b38874d59ffedbbc24277aeec977293271726d6c70922fee69a748a8ce16
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                    • SHA256 5b77a67b8791667106031036fb6149a7d9a276afb774dd192ce101b2e7b9679d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 3.9MB
                                                                                                                                                                                                                    • SHA256 b21bbab0708062c791ed4812826049a985f77107d3882218275d6347ea2a81c8
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.5MB
                                                                                                                                                                                                                    • SHA256 f8cd8d934eff9af648b013fee6e6523f507b9bf69c586506fdf70cde252cd138
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                                                                    • SHA256 14b74bea44d72894a16b53eff8bd3e68124567a50cc7aa5d05d2e83dd0d4913e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                                                                    • SHA256 25d49ebcdf5c400c0ae4b8a7c46aff0c8f5e5862145a1032b72dfe847fe3a1c6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.3MB
                                                                                                                                                                                                                    • SHA256 15028074c9bb62d507c02ce9cd1b38aec4c6ca727ce61fdacebdd201f8c49c48
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\937d940e12dba692e07314f29c70e0b65e9a7e47fc3f874f8a0e5ae1b1e88fc8.exe.exe
                                                                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                                                                    • SHA256 88eea864e4060a65ca2518060cfe14b3da94f7ca8306d8b2aca8b914f8086ee9
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-312252282-3884318443-358092420-1000\_desktop.ini
                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                    • SHA256 cf938a4f3b0b887724302ddf4689d13c4979f5470df615074767908c6ef30aa0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    memory/116-10414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/392-10223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/396-10121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/464-10039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/580-4399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/584-9999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/836-10439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/848-10198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/888-10344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/988-10319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/992-10051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1048-9974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1080-10369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1144-6704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1184-10273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1200-10055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1268-10011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-10374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1392-10359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1464-10258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1528-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1540-10263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1568-10076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1608-10007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1660-10092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1668-10143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1680-10023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1684-10003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1688-10253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1692-10329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1696-10465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1696-10460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1788-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1796-10015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1896-10084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1920-10208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1952-10113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2108-10419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2152-10228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2156-10449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2188-10278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2228-7501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2324-10019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2372-10213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2388-6034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2428-10105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2444-10389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2492-9995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2504-10299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2536-10394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2548-9970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2568-10203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2580-10153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2584-10334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2588-10163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2600-10129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2636-10354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2676-10459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2760-10035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2776-10158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2780-10434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2804-10379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2872-10183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2984-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2984-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2996-10188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3016-10193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3056-10148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3128-10314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3176-37-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3188-10268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3236-10138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3272-10364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3280-6931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3332-62-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3332-58-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3372-10409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3380-10429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3400-10071-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3416-10067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3440-9983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3468-10218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3492-10399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3496-10243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3536-10027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3652-10309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3676-10454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3684-9979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3752-10168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3760-10080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3784-10294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3820-10125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3868-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4048-10133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4084-7088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4168-10088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4184-10109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4212-10031-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4260-10043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4316-9380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4332-10117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4340-6052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4344-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4356-10233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4376-10101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4396-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4400-10384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4428-10047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4432-9965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4536-10444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4620-10096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4680-10288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4692-9991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4696-10324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4720-10059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4768-1815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4768-10072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4768-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4768-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4768-3716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4852-10063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4872-9987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4880-10248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4908-9958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4912-9978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4940-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4952-10283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4976-10304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4984-10339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4996-10404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5012-10173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5016-340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5024-10349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5028-10238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5052-10178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5060-10424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5112-1935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                    Download