Overview

overview

7

Static

static

3

6d4164df92...b0.exe

windows10-2004-x64

7

6d4164df92...b0.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 09:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
  • Size 2.5MB
  • Sample260602-lrtwssbv9j
  • SHA256 6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BDB.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5088
      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C77.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2344
          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1660
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E5C.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4796
              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1560
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F75.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2368
                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:1168
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40CD.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3148
                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2416
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41E6.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4036
                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1856
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F0.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1440
                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1592
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4428.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1284
                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4292
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3888
                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4628
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45FD.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:2196
                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:3292
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46E7.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3376
                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1876
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4801.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1416
                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3788
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48FB.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:392
                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1340
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A52.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2292
                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1636
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB0.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1872
                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:540
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B8B.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4492
                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2712
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C56.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3776
                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1628
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D6F.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2212
                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3884
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E88.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1920
                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1112
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a501F.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1536
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3240
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50F9.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1520
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3412
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51C5.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2532
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2704
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a531C.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2912
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2520
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55EB.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1916
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1756
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57B0.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2720
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1056
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a586C.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5032
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2440
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58F8.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:640
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2128
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5975.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2220
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:656
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59D3.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3340
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3568
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A6F.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1424
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1808
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ABD.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4604
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2296
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B69.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:1224
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5096
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C44.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4568
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4204
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DDA.bat
                                                                                                                                            68⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:900
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1060
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60C8.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2396
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:5072
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61E2.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:4372
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:2200
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a630A.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3396
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4928
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6414.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2496
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4816
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a650E.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:768
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:1380
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65F8.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1836
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:2160
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66C4.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4880
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:2800
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a680C.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:660
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4820
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6954.bat
                                                                                                                                                                                  86⤵
                                                                                                                                                                                    PID:3956
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2184
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69F0.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:344
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:228
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A4E.bat
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3248
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1176
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AAC.bat
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                  PID:824
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:1080
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AFA.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:1644
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1828
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B67.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BF4.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:3560
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C61.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:696
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CEE.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:448
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D8A.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FFB.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1840
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7078.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70E5.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:952
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7153.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:4248
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71D0.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a723D.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:3164
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72BA.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4040
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7318.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7385.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                              PID:2904
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73C4.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7402.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:492
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:812
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7450.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:4212
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a749E.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a751B.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                              PID:3244
                                      • C:\Windows\Logo1_.exe
                                        C:\Windows\Logo1_.exe
                                        2⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Enumerates connected drives
                                        • Drops file in Program Files directory
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        PID:4120
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop "Kingsoft AntiVirus Service"
                                          3⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4084
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4804

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          $$a3BDB.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3BDB.bat
                                          • Size 722B
                                          • SHA256 b86c023bb585a72d6b2ec29e0b8f5ec53e711f590184fac8bae94585757c0127
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a3C77.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3C77.bat
                                          • Size 722B
                                          • SHA256 6d920f9f87bd7e9af94362b0fe277bdfa795af08daec9d87f3b0e9b2e8e1f244
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a3E5C.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3E5C.bat
                                          • Size 722B
                                          • SHA256 05d3f2be56f77973af5ef074595200c816198b10adc34919be76a9adc7ab90d6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a3F75.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3F75.bat
                                          • Size 722B
                                          • SHA256 3bf2d655a79a99e0787fd880fd6561c72b48cc261fe31264fabb88046c8132e1
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a40CD.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a40CD.bat
                                          • Size 722B
                                          • SHA256 64381447f226a10f6ef11e33d83e0352292f8517757234f1a61ef385a03c8b2c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a41E6.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a41E6.bat
                                          • Size 722B
                                          • SHA256 a1985de10fe1c5dc3cc2545be492d59716d4f1954424ba6d61debb49305b517f
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a42F0.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a42F0.bat
                                          • Size 722B
                                          • SHA256 5dd1ebaf2bd5d53f9475ba17da2b601c579da852e25f13a137333e2245fc0644
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4428.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4428.bat
                                          • Size 722B
                                          • SHA256 e70b8cdce1f60dd5d8c02cbbc3ba07d6dff5b89bcc02117d69e112d9835ed0bf
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4541.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4541.bat
                                          • Size 722B
                                          • SHA256 ec6a52ec3e957e7152c0d74115145bb7e574767be8f19c49e47f93f246f1fb6d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a45FD.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a45FD.bat
                                          • Size 722B
                                          • SHA256 5f935b964542a1ce6092fcfef4a8dc657c1188f18bf8e7dad8518626e901c9e0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a46E7.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a46E7.bat
                                          • Size 722B
                                          • SHA256 bb6fd90bfe8e4a2bcc08a0daf96b066afa690a09d6277fa49722c44e55e415d9
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4801.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4801.bat
                                          • Size 722B
                                          • SHA256 fcdaead950bab8387758143cc75b7af02718fa4dd186baf23db6d53ebe141cdd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a48FB.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a48FB.bat
                                          • Size 722B
                                          • SHA256 c7c801374ce67ff282556b8dcea89b500f839725bde51679ffb1932f1dadeda4
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4A52.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4A52.bat
                                          • Size 722B
                                          • SHA256 45512a850884ef5539d27b8e5e95cf2baf521448b2d4125ddb068c211490cbf8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4AB0.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4AB0.bat
                                          • Size 722B
                                          • SHA256 5c2a5834e21a30f1b0bf66a50f50e9c4d985310651fc63d2b8a7b7bb58d50554
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4B8B.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4B8B.bat
                                          • Size 722B
                                          • SHA256 e9cb33cf6abb0250b10d967f27dac278bb9f716e1e9475e087ab359b3f47d446
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4C56.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4C56.bat
                                          • Size 722B
                                          • SHA256 d54bf82a65cb0494f3e41972e137238f6ac341f8644d48f651e6a588cd16fe12
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4D6F.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4D6F.bat
                                          • Size 722B
                                          • SHA256 8ff3a5909398b95f6d7254e15edb0dc9c7d09cde38978c0a2602f71051d8c5f2
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a4E88.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4E88.bat
                                          • Size 722B
                                          • SHA256 ce0d4bf77c76dfae778adab58facebb9e8a3823d15aa78f63ba93044df8581d0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a501F.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a501F.bat
                                          • Size 722B
                                          • SHA256 5fc6741054eae14f51fd06274790298282b4e6fa2635a55f786ef57cead8c10b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          $$a50F9.bat
                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a50F9.bat
                                          • Size 722B
                                          • SHA256 0be22027750b47ea1ca2cda08538652dd66740ed5d42849234c0e5da8299f471
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.5MB
                                          • SHA256 b9e5083e4d1868ca477d2da7f55191b7181cbf4268595c7e47d2a31899604ebd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.4MB
                                          • SHA256 74e8fade2fba347fc72d0b2fd4f30fc40d25450f66115a1d33963d555e76a843
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.5MB
                                          • SHA256 a6d1012e32f6fb588e7398d8bcfadc9f4e1d081a36bf881279a2f3fc0781e929
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.4MB
                                          • SHA256 88724579da4ce1c4a501437aa36034ec103fc0e3410a1f41fee70aaffd9a2b88
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.4MB
                                          • SHA256 fac32035b5732949e5bced6d13c6a2d53ef2005888c8a98813c6a500011af174
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.3MB
                                          • SHA256 047bb0705b2e4946db6a887852be41710e13e2c9241e0c39039891cc7260bbe4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.3MB
                                          • SHA256 2a075e97c69c5dbc6d24a3199ce230b2180ce7588bf59cd59b634a59e69cf00c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.2MB
                                          • SHA256 075234ea15f77d13be04b258c4dcdaf974adb99ba2d1cb329dcb2c7e9b0ffe8a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.3MB
                                          • SHA256 cf88e296de9cd11dbde5b651cc35dc9e12ee969c2d2db4b995817728e6e2f5f7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.2MB
                                          • SHA256 8ef016b3a5fd16d38710fde8148bd783ad877c6b5ca94951c621bac23c9a3d27
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.2MB
                                          • SHA256 1e88282f15bf1359d78157b66ba2086fa1983b79af25b0e395220cc1706e9de9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.1MB
                                          • SHA256 699f07a87a9ff9eb96f009d2c1f849e23b893839e8c785a8d73826d07882b0cd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.1MB
                                          • SHA256 f982ec87f51b176a572e8ef6459620c42f81b0356aa52b4bb91c9d6e4319f294
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.0MB
                                          • SHA256 c95337d5cfb3bed3243151647c7f6925779755952f2ded7571761048d832a4e5
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.1MB
                                          • SHA256 cfafb3029583b354a3cf656f2c1a5cb510e66d289d4663c26ebded314a03af2d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.0MB
                                          • SHA256 c631616c4726a58817673dadc97472b8af1a05f8ade6329550b7b6df3b77d9cf
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 2.0MB
                                          • SHA256 68a2197a38471aab5e657e42b399b03315a816a627c78679eedfeb5fd28830f4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 1.9MB
                                          • SHA256 c75a40fc1022f58babd1182f62448fd043e4cb978e1dccef3073a3e152d7f9a8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 1.9MB
                                          • SHA256 b5f2abd8b4fc6c8af3197aed5f04328c0d76ebd7394a810a3a689598b04cf0b9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\6d4164df929a7963d1defee852965cf2e815324f32103ff6e7fa14f6500aa2b0.exe.exe
                                          • Size 1.9MB
                                          • SHA256 eb7d7ef3df78f44ae9ef100ccd211f679d4585a3162118e56bd805f8d33f6452
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Logo1_.exe
                                          • Path C:\Windows\Logo1_.exe
                                          • Size 32KB
                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          _desktop.ini
                                          • Path F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\_desktop.ini
                                          • Size 8B
                                          • SHA256 e2216e9f68ad9e2b4808eebcb8f03d71f7490b447fa87bf0fc3a1d28d604dcf0
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          memory/228-5692-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/448-5836-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/540-133-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/656-1938-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/812-6263-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/952-6227-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1056-1926-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1060-2994-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1080-5700-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1112-164-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1152-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1168-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1176-5696-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1340-119-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1380-4633-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1560-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1592-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1628-147-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1636-126-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1660-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1756-1922-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1808-1946-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1828-5704-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1856-58-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/1876-101-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2128-1934-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2160-4917-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2184-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2200-3794-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2296-1950-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2384-5708-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2416-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2428-6273-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2428-6268-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2440-1930-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2488-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2488-15-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2520-1632-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2704-489-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2712-140-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/2800-5301-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3164-6239-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3240-171-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3292-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3352-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3412-202-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3420-6235-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3568-1942-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3788-108-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/3884-156-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4040-6243-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4052-6259-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4120-90-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4120-8-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4120-3993-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4204-2768-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4212-6267-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4248-6231-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4292-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4516-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4516-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4552-6247-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4628-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4768-6251-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4816-4399-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4820-5684-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4896-5712-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/4928-4101-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5064-5716-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5072-3362-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5092-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download

                                          memory/5096-2228-0x0000000000400000-0x0000000000445000-memory.dmp
                                          Download