Overview

overview

7

Static

static

3

30ae58c12a...cb.exe

windows10-2004-x64

7

30ae58c12a...cb.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/04/2026, 10:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
  • Size 3.2MB
  • Sample260428-l2tnsaf16w
  • SHA256 30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a952.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1800
          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2896
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2C.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3564
              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3372
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB17.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2852
                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4444
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC01.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1900
                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:8
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1332
                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4252
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3768
                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1616
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1028
                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2224
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1668
                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3384
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a117F.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3304
                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2956
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1373.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3588
                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3336
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15B6.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:772
                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:544
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17F8.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2212
                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2072
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A0B.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3580
                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3204
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C7C.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4476
                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1444
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FD7.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1548
                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4508
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a220A.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4804
                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:944
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24C9.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1812
                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4584
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27B7.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4108
                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3232
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B60.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2136
                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3180
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E5E.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1908
                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1080
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E8D.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3244
                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3056
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EBC.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:228
                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1840
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EEB.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4800
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:924
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F29.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4992
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4304
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F68.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1556
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3952
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F97.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3664
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3924
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FC5.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4684
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1120
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3004.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:892
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4652
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3033.bat
                                                                                                                          60⤵
                                                                                                                            PID:568
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1328
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3071.bat
                                                                                                                                62⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4528
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2748
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B0.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5032
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2428
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30DF.bat
                                                                                                                                          66⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2268
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:1476
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a310E.bat
                                                                                                                                              68⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4200
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:3164
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a314C.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2100
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3940
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a317B.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4564
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4232
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31AA.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:2964
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3756
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E8.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4004
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:3596
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3217.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:1984
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3568
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3246.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:3676
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:5108
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3285.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:2352
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:3892
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32C3.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:3116
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3972
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32F2.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3321.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a335F.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1884
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a338E.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                PID:3872
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1112
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33CD.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                      PID:3860
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4112
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a340B.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:416
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a343A.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3828
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3469.bat
                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                      101⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3498.bat
                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34D6.bat
                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:668
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3505.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3544.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:1472
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3573.bat
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:2264
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35A1.bat
                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3192
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3540
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D0.bat
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35FF.bat
                                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                                PID:4432
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a363E.bat
                                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2684
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a366D.bat
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3096
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36CA.bat
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36F9.bat
                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3738.bat
                                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3767.bat
                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37B5.bat
                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                      PID:792
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37F3.bat
                                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3822.bat
                                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                                  PID:4772
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3851.bat
                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a388F.bat
                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:2668
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38BE.bat
                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3324
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38FD.bat
                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a392C.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a396A.bat
                                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3999.bat
                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39C8.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:1160
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39F7.bat
                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1924
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A26.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:236
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A64.bat
                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4116
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A93.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:444
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BFA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:492
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5016
                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                            40⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:3312
                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                              41⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:1076
                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                42⤵
                                                                                                                                                                                  PID:4432
                                                                                                • C:\Windows\Logo1_.exe
                                                                                                  C:\Windows\Logo1_.exe
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Enumerates connected drives
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4488
                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                    3⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1244
                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                      4⤵
                                                                                                        PID:4868

                                                                                                Network

                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      $$a117F.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a117F.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 9eaeec8fd1fa741bb2f186fc327cedfac90303386535ce15cac25321952fa183
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a1373.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1373.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 9b8bc490209efeb955db56e76f1e9b05826270cbbd638489f985da0271397205
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a15B6.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a15B6.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 a0f3fa67c42ebaea881ce8fd510783c42cade37940382c4ee8da562b6e074a05
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a17F8.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a17F8.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 505f18456007a97bc981a78f63079829dd9219f34b3ac547961cb48ac9def6e2
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a1A0B.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1A0B.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 9d058070baa90cd6029f6d8aa7007ce072fa7f57048b26f623329a233a519370
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a1C7C.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1C7C.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 ab004ba2c9097348f0c38cf4bc2403bbc274dcbbf2451212231acbc8516cd602
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a1FD7.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1FD7.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 8f9131c08130cf5d1cfc97f788e2b95b253df4b958c4611a296145d461444483
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a220A.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a220A.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 1d1609422759de6a4daf0ffc49d0d871bbbfb44cabfc3416a79727b8f41c5d66
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a24C9.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a24C9.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 f504f4f91c9d38f29be85e80d55e81b94771e436a54412b60ffc1eb1b09de939
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a27B7.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a27B7.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 a357ebc24c40dec20567111fe4dcd734ce8416f57f58b91652521e6376b52ce8
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a2B60.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2B60.bat
                                                                                                      • Size 722B
                                                                                                      • SHA256 e869b5029be34a31efbef33b2b64dc6abde4fd0069283c23288af0a95b98df56
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a838.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a838.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 5c9ba729d920e923b439e5da2c0c0732fcd2888d57e7e8a25361493f34e236dc
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$a952.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a952.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 5ab332c51359b2020bdfa2174d22fbb8836789f84a2481dc191ab623198ae94a
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aA2C.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA2C.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 d2d47bcd46ce52332c322633d5affc3615e32e245be6f6e55b2baddf8155b09f
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aB17.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB17.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 eab2bec547b9fa04a16685779094a5cf7093d0b30901f7fec5c8b8fd95c06d6c
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aC01.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC01.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 980b2e823a852be573acac40e6f13c76050f9b87328d8de32c953b1fdbadcc99
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aCBD.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCBD.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 9cdc3effe69163d0f64370851c0b1ab7247183f9d9087db89b8c78577bed03cd
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aD97.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD97.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 f9533acc20b9fc2331648f6ff2bf184f60f3de1d1db2c59271fc569a89a7eb5f
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aE63.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE63.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 a9d964c82ae4e6651c1583106a62676aff52e93d7b3ce23e0a90d17ae6a62ece
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      $$aFE9.bat
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aFE9.bat
                                                                                                      • Size 721B
                                                                                                      • SHA256 685b5c513abf1fda9b1daeafa90af716b24bdc023a99d321dbdcc6dcafaea390
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Size 2.9MB
                                                                                                      • SHA256 3b95e3fa6d29caef72b730fa0040b0b3820fdcd62577a1c8549baa3e10f0c7ba
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Size 2.9MB
                                                                                                      • SHA256 8adc21d6f226725bd6201036982911059648bdcaca3110d8f6ed3e629396822f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe
                                                                                                      • Size 2.7MB
                                                                                                      • SHA256 707cb184c29cde905a285e80833f74ed79a6c8b8fb08753dd4b4b03de17e5fe3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.7MB
                                                                                                      • SHA256 df89d4f6989826af2e24e366ee4d73bb1b6b86476582740511902916f8d4eefa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.6MB
                                                                                                      • SHA256 2afd7f20898336b915cbb3f77050689359efddd3be7a47b4fbb9deae5b09f5ce
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.0MB
                                                                                                      • SHA256 efdb462d86fcad3c40605db2726449d071bcb7241de0262fa6cc45bd0384ba0a
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.2MB
                                                                                                      • SHA256 c0c0bf27db2c775f111ec571475d117d2896aacf379fc780cb09452639e40362
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.0MB
                                                                                                      • SHA256 411ed0ec6694308677c4471aa75b517e3c4866bfbe0c2245c3aadd3a7e68e2a0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.1MB
                                                                                                      • SHA256 8201285bac446f43a861c47cea484e0ce08a10ada2bfe1108c2b87d1c33bc7f7
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.2MB
                                                                                                      • SHA256 11a6a5847b7f16bc4e3e6404480aad51087ae9673a0554ebf49cf58fac6d4e6a
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.9MB
                                                                                                      • SHA256 7c3e23e27a609ef194012a870809012d03e86a06a7f311415493da2cfff62f60
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.1MB
                                                                                                      • SHA256 8157b59524c09701a5b54e7d1d8cd8181bd60d12e25430a1d8758f4a85adb59f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.8MB
                                                                                                      • SHA256 227a69c0d1fb172a3e77cf6b6531f77a7d0090e225673d7aeaf57e73d409dc38
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.1MB
                                                                                                      • SHA256 977d11d3aeb44c4945c8f8d500833597c98b0297ffc4a48da982f723ec97d8b9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.8MB
                                                                                                      • SHA256 c5c4b164e4e485121aaac40756c16dbfc08d3fcad4058cd48710b2215ff501e7
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 3.0MB
                                                                                                      • SHA256 404f793f17c2175c31669233db9b408b5b432cf55ae7f3c8f26ba7fb633b1405
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.8MB
                                                                                                      • SHA256 78649ccea3702500bf0bdfc1d7436276457ae5b36a670e4a101e949c9cb71f01
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.7MB
                                                                                                      • SHA256 e42a67cf938e9db97fcd7c9219533969003784cf9ad65d8579260e1a42bf0311
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\30ae58c12a237236688246898413ad14d717b4d03c4ba50cd5d3776541f338cb.exe.exe
                                                                                                      • Size 2.6MB
                                                                                                      • SHA256 bc123fd129809480152daf5aa9c8963b7c073155b271182c4c9fcfc0ad520b58
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Logo1_.exe
                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                      • Size 32KB
                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      _desktop.ini
                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1383858298-2057492509-1726743289-1000\_desktop.ini
                                                                                                      • Size 9B
                                                                                                      • SHA256 3708b4e0363dfdc0bd7db87d4d2bdd4e1ae9a0187285c0013405e55a36ae63d3
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      memory/8-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/236-2183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/444-2198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/544-111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/572-2128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/924-1954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/944-1910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/976-2032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1080-1942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1112-2044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1120-1970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1160-2173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1328-1979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1344-2223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1444-1854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1460-2208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1464-2123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1476-1991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1536-2118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1568-2188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1616-64-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1644-2113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1660-2138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1728-2088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1840-1950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1880-2072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1884-2040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1924-2178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2020-2036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2072-120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2176-2228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2192-2068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2196-2052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2224-72-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2264-2080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2348-2153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2428-1987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2476-2218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2580-2168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2640-2163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2644-2104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2684-2096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2744-2229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2744-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2748-1983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2752-2076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2896-27-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2956-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3056-1946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3096-2100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3124-2203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3128-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3128-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3164-1995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3180-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3204-127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3232-1931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3312-1971-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3324-2148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3336-104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3372-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3384-85-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3408-2193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3540-2084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3568-2016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3596-2012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3756-2008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3828-2056-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3848-2158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3892-2024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3924-1966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3940-1999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3952-1962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3972-2028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4112-2048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4232-2003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4248-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4252-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4304-1958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4344-2213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4416-2064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4444-41-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4460-2133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4488-1919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4488-1920-0x0000000003A00000-0x0000000003AC1000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4488-89-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4488-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4508-1861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4568-2108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4584-1917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4652-1975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4736-2092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4828-2143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5028-2060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5108-2020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                      Download